{"id":"CVE-2026-74404","title":"crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one\n\nSashiko notes:\n\n> regarding the bounds check in snp_filter_reserved_mem_regions()\n> called via walk_iome…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < 830c1f3e71989448652973375ef5e39b6ede47a3","Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < c5c79d92da0f9a09f48be5e2aabed2d6d1a96294","Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < af7341616b742ad2c374a90998bd650a035f694d","Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < 1b864b6cb213bbd7b406e9b2e98c962077f300df","Linux 6.9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:55:44.374861Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:43.034Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74404","references":[{"url":"https://git.kernel.org/stable/c/830c1f3e71989448652973375ef5e39b6ede47a3"},{"url":"https://git.kernel.org/stable/c/c5c79d92da0f9a09f48be5e2aabed2d6d1a96294"},{"url":"https://git.kernel.org/stable/c/af7341616b742ad2c374a90998bd650a035f694d"},{"url":"https://git.kernel.org/stable/c/1b864b6cb213bbd7b406e9b2e98c962077f300df"}],"tags":["cve.org"],"epss":0.00189,"epssPercentile":0.08014,"ingestedAt":"2026-10-16T19:46:24.368Z","slug":"CVE-2026-74404","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one\n\nSashiko notes:\n\n> regarding the bounds check in snp_filter_reserved_mem_regions()\n> called via walk_iomem_res_desc(): does the check\n> if ((range_list->num_elements * 16 + 8) > PAGE_SIZE)\n> allow an off-by-one heap buffer overflow?\n>\n> If range_list->num_elements is 255, 255 * 16 + 8 = 4088, which is <= 4096.\n> Writing range->base (8 bytes) fills 4088-4095, but writing range->page_count\n> (4 bytes) would write to 4096-4099, overflowing the kzalloc-allocated\n> PAGE_SIZE buffer.\n\nFix this by accounting for the entry about to be written to, in addition to\nthe entries that are already allocated.\n\n## Affected\n\n- `Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < 830c1f3e71989448652973375ef5e39b6ede47a3`\n- `Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < c5c79d92da0f9a09f48be5e2aabed2d6d1a96294`\n- `Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < af7341616b742ad2c374a90998bd650a035f694d`\n- `Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < 1b864b6cb213bbd7b406e9b2e98c962077f300df`\n- `Linux 6.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}