Skip to content
Heist/ feed
Unrated

remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() table->offset[i] is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer. The subsequent avail check was bypassed because the negative int was promoted to a large size_t in the expression "table_sz - offset - sizeof(*hdr)", yielding a large positive avail and letting the out-of-bounds hdr->type read proceed undetected. Store the offset as u32 and validate it with unsigned comparisons before any pointer arithmetic.

Announced Source revision 1
Original source ↗

CVE-2026-90314

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-90314

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
        "lessThan": "0d385be8f199b349f325cf90584b47b6a044ea79",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
        "lessThan": "cc85e0d3d3333fd5fd2d50c9a4578d209d7f2564",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
        "lessThan": "6a01ad25aa4f3a02153cf1d112cb9b65865cd5d8",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
        "lessThan": "c82241a9454b2d30d53b50884f94b7972ba44a5e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
        "lessThan": "bc4940793aaa16a9cf90063b11d6926f8014a1b7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
        "lessThan": "6fd220604f06c746760183df74b07384c3fdd660",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
        "lessThan": "6282d47b24b0c98d08d02807d676a7f67b4c052e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9",
        "lessThan": "bb840ea69347aff7bde5a208e7b5b180669a7656",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "include/linux/rsc_table.h"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3.4"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "3.4",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.270",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.221",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.188",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.157",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.110",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.52",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.6",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "include/linux/rsc_table.h"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-90314

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#36665 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement