{"id":"CVE-2026-90314","revision":"37613ff58f694a1e98bb31abf22867c6","records":[{"revision":"37613ff58f694a1e98bb31abf22867c6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90314","aliases":[],"title":"remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()\n\ntable->offset[i] is a u32 from firmware, but was stored into a signed\nint.  A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes\nbefore the table buffer.  The subsequent avail check was bypassed\nbecause the negative int was promoted to a large size_t in the\nexpression \"table_sz - offset - sizeof(*hdr)\", yielding a large positive\navail and letting the out-of-bounds hdr->type read proceed undetected.\n\nStore the offset as u32 and validate it with unsigned comparisons before\nany pointer arithmetic.","state":0,"publishedAt":"2026-09-17T16:08:33.568+00:00","modifiedAt":"2026-10-19T09:01:30.762+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/rsc_table.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9\",\n                            \"lessThan\": \"0d385be8f199b349f325cf90584b47b6a044ea79\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9\",\n                            \"lessThan\": \"cc85e0d3d3333fd5fd2d50c9a4578d209d7f2564\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9\",\n                            \"lessThan\": \"6a01ad25aa4f3a02153cf1d112cb9b65865cd5d8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9\",\n                            \"lessThan\": \"c82241a9454b2d30d53b50884f94b7972ba44a5e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9\",\n                            \"lessThan\": \"bc4940793aaa16a9cf90063b11d6926f8014a1b7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9\",\n                            \"lessThan\": \"6fd220604f06c746760183df74b07384c3fdd660\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9\",\n                            \"lessThan\": \"6282d47b24b0c98d08d02807d676a7f67b4c052e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9\",\n                            \"lessThan\": \"bb840ea69347aff7bde5a208e7b5b180669a7656\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/rsc_table.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/0d385be8f199b349f325cf90584b47b6a044ea79","https://git.kernel.org/stable/c/cc85e0d3d3333fd5fd2d50c9a4578d209d7f2564","https://git.kernel.org/stable/c/6a01ad25aa4f3a02153cf1d112cb9b65865cd5d8","https://git.kernel.org/stable/c/c82241a9454b2d30d53b50884f94b7972ba44a5e","https://git.kernel.org/stable/c/bc4940793aaa16a9cf90063b11d6926f8014a1b7","https://git.kernel.org/stable/c/6fd220604f06c746760183df74b07384c3fdd660","https://git.kernel.org/stable/c/6282d47b24b0c98d08d02807d676a7f67b4c052e","https://git.kernel.org/stable/c/bb840ea69347aff7bde5a208e7b5b180669a7656"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90314","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90314","identifiers":["CVE-2026-90314"]},"retained":false,"historicalAffected":[]}],"coverage":[]}