CVE-2026-97990

Received Received - Intake

vdpa_sim_net TX Pull Result Validation Flaw

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_net: check TX pull result before RX copy vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path. Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes. I found this bug myself, though the patch was written with AI assistance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97990

EUVD

EUVD-2026-86644

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of TX pull results in the vdpa_sim_net driver. The function vringh_iov_pull_iotlb() returns a signed byte count, but a failed TX pull (negative value) is incorrectly added to an unsigned byte counter. This negative error can become a large positive length, affecting the RX path operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's vdpa_sim_net driver and involves incorrect handling of TX pull results. Detection requires checking kernel logs for related errors or kernel crashes involving vringh_iov_pull_iotlb or vringh_iov_push_iotlb functions. Use commands like dmesg | grep vdpa or journalctl -k | grep vringh to inspect kernel logs for anomalies.

Impact Analysis

This vulnerability could lead to memory corruption or unexpected behavior in the Linux kernel's vdpa_sim_net driver. It may cause crashes, data corruption, or security issues if exploited, potentially allowing unauthorized access or denial of service.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with GDPR, HIPAA, or similar standards. The vulnerability involves a signed byte count error in the Linux kernel's vdpa_sim_net driver, which could lead to memory corruption or denial of service. Such issues may indirectly affect compliance by compromising system integrity or availability, but no explicit regulatory impact is described.

Mitigation Strategies

Apply the latest kernel update or patch that resolves this issue. If a patch is not yet available, consider disabling the vdpa_sim_net driver if it is not critical to your system's operation. Monitor kernel security advisories for updates.

Hi! I’m here to help you understand CVE-2026-97990. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70