{"id":"CVE-2026-97990","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim_net: check TX pull result before RX copy\n\nvringh_iov_pull_iotlb() returns a signed byte count","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim_net: check TX pull result before RX copy\n\nvringh_iov_pull_iotlb() returns a signed byte count.  A failed TX pull is\ncurrently added to the unsigned byte counte…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= cfe226892913a448e83e7a19db93862baa3cb99c < c001abcde865b74231da8f1412c3217dbf66781e","Linux >= cfe226892913a448e83e7a19db93862baa3cb99c < 3af20238a09ca180d66623e3bed16b64e9975f39","Linux >= cfe226892913a448e83e7a19db93862baa3cb99c < 2bbf1c1f69991e28787e02b0a2f826289d5fc730","Linux >= cfe226892913a448e83e7a19db93862baa3cb99c < 0d195797a80b77f2ec56718cd26d3ee65d0093e8","Linux 5.19"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T11:17:27.113","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97990","references":[{"url":"https://git.kernel.org/stable/c/0d195797a80b77f2ec56718cd26d3ee65d0093e8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2bbf1c1f69991e28787e02b0a2f826289d5fc730","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3af20238a09ca180d66623e3bed16b64e9975f39","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c001abcde865b74231da8f1412c3217dbf66781e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-25T11:06:38.865Z","slug":"CVE-2026-97990","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim_net: check TX pull result before RX copy\n\nvringh_iov_pull_iotlb() returns a signed byte count.  A failed TX pull is\ncurrently added to the unsigned byte counter and then passed as a size_t\nlength to receive_filter() and vringh_iov_push_iotlb().  A negative error\ncan therefore become a large length in the RX path.\n\nHandle non-positive pull results before every length use.  Count the TX\nerror and complete the consumed TX descriptor with zero bytes.\n\nI found this bug myself, though the patch was written with AI assistance.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}