CVE-2026-90314
CVE CVE-2026-90314EUVD EUVD-2026-81975Published 2026-09-17T16:08:33.000Z
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() table->offset[i] is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer. The subsequent avail check was bypassed because the negative int was promoted to a large size_t in the expression "table_sz - offset - sizeof(*hdr)", yielding a large positive avail and letting the out-of-bounds hdr->type read proceed undetected. Store the offset as u32 and validate it with unsigned comparisons before any pointer arithmetic.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <6282d47b24b0c98d08d02807d676a7f67b4c052e; patch: 6.1.188; fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <bc4940793aaa16a9cf90063b11d6926f8014a1b7; 3.4; fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <bb840ea69347aff7bde5a208e7b5b180669a7656; patch: 6.6.157; patch: 6.18.52; fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <c82241a9454b2d30d53b50884f94b7972ba44a5e; fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <cc85e0d3d3333fd5fd2d50c9a4578d209d7f2564; fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <0d385be8f199b349f325cf90584b47b6a044ea79; patch: 5.10.270; patch: 5.15.221; patch: 0; patch: 7.3-rc1; fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <6fd220604f06c746760183df74b07384c3fdd660; patch: 7.2.6; patch: 6.12.110; fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <6a01ad25aa4f3a02153cf1d112cb9b65865cd5d8
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.