Strix
64.8K

CVE-2026-97990

HIGHCVSS 7.5/10

Last modified

CVE-2026-97990 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_net: check TX pull result before RX copy vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb().

Description

In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_net: check TX pull result before RX copy vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path. Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes. I found this bug myself, though the patch was written with AI assistance.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:H

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= cfe226892913a448e83e7a19db93862baa3cb99c, < c001abcde865b74231da8f1412c3217dbf66781e; >= cfe226892913a448e83e7a19db93862baa3cb99c, < 3af20238a09ca180d66623e3bed16b64e9975f39; >= cfe226892913a448e83e7a19db93862baa3cb99c, < 2bbf1c1f69991e28787e02b0a2f826289d5fc730; >= cfe226892913a448e83e7a19db93862baa3cb99c, < 0d195797a80b77f2ec56718cd26d3ee65d0093e8
LinuxLinux5.19

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-97990?
In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_net: check TX pull result before RX copy vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path. Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes. I found this bug myself, though the patch was written with AI assistance.
How severe is CVE-2026-97990?
CVE-2026-97990 has a CVSS score of 7.5/10 (HIGH severity).
How do I fix CVE-2026-97990?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-97990?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST