{"id":"CVE-2026-90416","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs\n\nget_param() reads a congestion parameter as a u32 but formats it with the\nsigned \"%d\" into an 11-byte stac…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs\n\nget_param() reads a congestion parameter as a u32 but formats it with the\nsigned \"%d\" into an 11-byte stac…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 4a2da0b8c0782816f3ae6846ae7942fcbb0f8172 < 1c5b4f76cd73372c5a8a4c91c95d5a31f141e091","Linux >= 4a2da0b8c0782816f3ae6846ae7942fcbb0f8172 < 06b62758f81e27ca4c81201c22e3436c6d9ac894","Linux >= 4a2da0b8c0782816f3ae6846ae7942fcbb0f8172 < d809cf3f0ed9255abfc73c4730bcf187151422af","Linux >= 4a2da0b8c0782816f3ae6846ae7942fcbb0f8172 < 0b0122fcc923a0271130f5fb71af2cd7e20434d9","Linux >= 4a2da0b8c0782816f3ae6846ae7942fcbb0f8172 < ce8dfd32a33b578c3abf178f67b4c8d36854f041","Linux >= 4a2da0b8c0782816f3ae6846ae7942fcbb0f8172 < 4599311e78e88c893ad551aca622de2bfdf1c31f","Linux >= 4a2da0b8c0782816f3ae6846ae7942fcbb0f8172 < c75ee076fa09778a2f9602a972dade4a0b0785f7","Linux >= 4a2da0b8c0782816f3ae6846ae7942fcbb0f8172 < 03826bc1fa6c90405bf05831f2b501a8368dcd27","Linux 4.14"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:17:45.880","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90416","references":[{"url":"https://git.kernel.org/stable/c/03826bc1fa6c90405bf05831f2b501a8368dcd27","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/06b62758f81e27ca4c81201c22e3436c6d9ac894","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0b0122fcc923a0271130f5fb71af2cd7e20434d9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1c5b4f76cd73372c5a8a4c91c95d5a31f141e091","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4599311e78e88c893ad551aca622de2bfdf1c31f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c75ee076fa09778a2f9602a972dade4a0b0785f7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce8dfd32a33b578c3abf178f67b4c8d36854f041","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d809cf3f0ed9255abfc73c4730bcf187151422af","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-17T16:21:47.797Z","epss":0.0021,"epssPercentile":0.11544,"slug":"CVE-2026-90416","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs\n\nget_param() reads a congestion parameter as a u32 but formats it with the\nsigned \"%d\" into an 11-byte stack buffer. A value with bit 31 set, such as\n0x80000000, renders as \"-2147483648\\n\" whose full length is 12. snprintf()\nstores only 11 bytes yet returns 12, so simple_read_from_buffer() treats 12\nbytes as valid and reads one byte past lbuf[].\n\nSize the buffer for the widest unsigned decimal, format with \"%u\" to match\nthe u32, and use scnprintf() so the length passed to\nsimple_read_from_buffer() reflects the bytes actually stored.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}