CVE-2026-90314
Last modified
CVE-2026-90314 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() table->offset[i] is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer.
Description
In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() table->offset[i] is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer. The subsequent avail check was bypassed because the negative int was promoted to a large size_t in the expression "table_sz - offset - sizeof(*hdr)", yielding a large positive avail and letting the out-of-bounds hdr->type read proceed undetected. Store the offset as u32 and validate it with unsigned comparisons before any pointer arithmetic.
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9, < 0d385be8f199b349f325cf90584b47b6a044ea79; >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9, < cc85e0d3d3333fd5fd2d50c9a4578d209d7f2564; >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9, < 6a01ad25aa4f3a02153cf1d112cb9b65865cd5d8; >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9, < c82241a9454b2d30d53b50884f94b7972ba44a5e; >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9, < bc4940793aaa16a9cf90063b11d6926f8014a1b7; >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9, < 6fd220604f06c746760183df74b07384c3fdd660; >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9, < 6282d47b24b0c98d08d02807d676a7f67b4c052e; >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9, < bb840ea69347aff7bde5a208e7b5b180669a7656 |
| Linux | Linux | 3.4 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-90314?
How severe is CVE-2026-90314?
How do I fix CVE-2026-90314?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-90309In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-9031An input validation vulnerability exists in the HTTP-WRITEOE…6.8
- CVE-2026-90310Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-90311In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90312In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-90313In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90315In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90316In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-90317In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-90318In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90319In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90320In the Linux kernel, the following vulnerability has been re…7.8
Are you affected by CVE-2026-90314?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST