---
id: CVE-2026-74404
title: 'crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one

  Sashiko notes:

  > regarding the bounds check in snp_filter_reserved_mem_regions()
  > called via walk_iome…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 <
    830c1f3e71989448652973375ef5e39b6ede47a3
  - >-
    Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 <
    c5c79d92da0f9a09f48be5e2aabed2d6d1a96294
  - >-
    Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 <
    af7341616b742ad2c374a90998bd650a035f694d
  - >-
    Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 <
    1b864b6cb213bbd7b406e9b2e98c962077f300df
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:55:44.374861Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:43.034Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74404'
references:
  - url: 'https://git.kernel.org/stable/c/830c1f3e71989448652973375ef5e39b6ede47a3'
  - url: 'https://git.kernel.org/stable/c/c5c79d92da0f9a09f48be5e2aabed2d6d1a96294'
  - url: 'https://git.kernel.org/stable/c/af7341616b742ad2c374a90998bd650a035f694d'
  - url: 'https://git.kernel.org/stable/c/1b864b6cb213bbd7b406e9b2e98c962077f300df'
tags:
  - cve.org
epss: 0.00189
epssPercentile: 0.08014
ingestedAt: '2026-10-16T19:46:24.368Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one

Sashiko notes:

> regarding the bounds check in snp_filter_reserved_mem_regions()
> called via walk_iomem_res_desc(): does the check
> if ((range_list->num_elements * 16 + 8) > PAGE_SIZE)
> allow an off-by-one heap buffer overflow?
>
> If range_list->num_elements is 255, 255 * 16 + 8 = 4088, which is <= 4096.
> Writing range->base (8 bytes) fills 4088-4095, but writing range->page_count
> (4 bytes) would write to 4096-4099, overflowing the kzalloc-allocated
> PAGE_SIZE buffer.

Fix this by accounting for the entry about to be written to, in addition to
the entries that are already allocated.

## Affected

- `Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < 830c1f3e71989448652973375ef5e39b6ede47a3`
- `Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < c5c79d92da0f9a09f48be5e2aabed2d6d1a96294`
- `Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < af7341616b742ad2c374a90998bd650a035f694d`
- `Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < 1b864b6cb213bbd7b406e9b2e98c962077f300df`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.