{"id":"CVE-2026-90314","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()\n\ntable->offset[i] is a u32 from firmware, but was stored into a signed\nint","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()\n\ntable->offset[i] is a u32 from firmware, but was stored into a signed\nint.  A crafted offset l…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 < 0d385be8f199b349f325cf90584b47b6a044ea79","Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 < cc85e0d3d3333fd5fd2d50c9a4578d209d7f2564","Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 < 6a01ad25aa4f3a02153cf1d112cb9b65865cd5d8","Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 < c82241a9454b2d30d53b50884f94b7972ba44a5e","Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 < bc4940793aaa16a9cf90063b11d6926f8014a1b7","Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 < 6fd220604f06c746760183df74b07384c3fdd660","Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 < 6282d47b24b0c98d08d02807d676a7f67b4c052e","Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 < bb840ea69347aff7bde5a208e7b5b180669a7656","Linux 3.4"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:17:29.203","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90314","references":[{"url":"https://git.kernel.org/stable/c/0d385be8f199b349f325cf90584b47b6a044ea79","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6282d47b24b0c98d08d02807d676a7f67b4c052e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6a01ad25aa4f3a02153cf1d112cb9b65865cd5d8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fd220604f06c746760183df74b07384c3fdd660","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb840ea69347aff7bde5a208e7b5b180669a7656","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc4940793aaa16a9cf90063b11d6926f8014a1b7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c82241a9454b2d30d53b50884f94b7972ba44a5e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc85e0d3d3333fd5fd2d50c9a4578d209d7f2564","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-17T16:21:47.825Z","epss":0.00221,"epssPercentile":0.12889,"slug":"CVE-2026-90314","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()\n\ntable->offset[i] is a u32 from firmware, but was stored into a signed\nint.  A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes\nbefore the table buffer.  The subsequent avail check was bypassed\nbecause the negative int was promoted to a large size_t in the\nexpression \"table_sz - offset - sizeof(*hdr)\", yielding a large positive\navail and letting the out-of-bounds hdr->type read proceed undetected.\n\nStore the offset as u32 and validate it with unsigned comparisons before\nany pointer arithmetic.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}