In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_net: check TX pull result before RX copy vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path. Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes. I found this bug myself, though the patch was written with AI assistance.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 2
- StatusReceived → PublishedNVD modified 2026-10-19 09:11
- First seenCVSS 7.5NVD modified 2026-10-19 10:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://git.kernel.org/stable/c/0d195797a80b77f2ec56718cd26d3ee65d0093e8
- https://git.kernel.org/stable/c/1b803d382cde6d85755b363f22010208a04ba40a
- https://git.kernel.org/stable/c/2bbf1c1f69991e28787e02b0a2f826289d5fc730
- https://git.kernel.org/stable/c/3af20238a09ca180d66623e3bed16b64e9975f39
- https://git.kernel.org/stable/c/c001abcde865b74231da8f1412c3217dbf66781e