---
id: CVE-2026-90082
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: mana: Cap MSI-X vectors to the device MSI-X table size

  mana_gd_query_max_resources() sizes gc->num_msix_usable from resp.max_msix
  and the CPU count, but never fro…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: mana: Cap MSI-X vectors to the device MSI-X table size

  mana_gd_query_max_resources() sizes gc->num_msix_usable from resp.max_msix
  and the CPU count, but never fro…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 755391121038c06cb653241aa94dcabd87179f62 <
    4f9827b314ee57cd99f86f8dbadcaf567112e2b2
  - >-
    Linux >= 755391121038c06cb653241aa94dcabd87179f62 <
    2c7493f980140a5c40eb4f98f97c557193a2c330
  - Linux 6.17
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:16:57.573'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90082'
references:
  - url: 'https://git.kernel.org/stable/c/2c7493f980140a5c40eb4f98f97c557193a2c330'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4f9827b314ee57cd99f86f8dbadcaf567112e2b2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.895Z'
epss: 0.00198
epssPercentile: 0.08532
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Cap MSI-X vectors to the device MSI-X table size

mana_gd_query_max_resources() sizes gc->num_msix_usable from resp.max_msix
and the CPU count, but never from the device MSI-X table. On a 1792 vCPU
M-series VM that yields 1793 while the table has 1024 entries, and
mana_gd_setup_remaining_irqs() then walks indices 1..1792, running off the
end of the region mapped by msix_map_region():

  BUG: unable to handle page fault for address: ff8e347f8b99800c
  RIP: 0010:msix_prepare_msi_desc+0x7a/0x90
  RAX: 0000000000004000 RBX: ff4330cb164ea780 RCX: ff8e347f8b998000
  Call Trace:
   <TASK>
   __msi_domain_alloc_irqs+0x13a/0x440
   msi_domain_alloc_irq_at+0x149/0x1b0
   mana_gd_setup+0x351/0x890
   mana_gd_probe+0x274/0x390
   </TASK>

RAX is index 1024 * PCI_MSIX_ENTRY_SIZE, one entry past the table.

msi_insert_desc() does range check the index, but only against the MSI
domain hwsize, which matches the table only for devices on an MSI parent
domain. With a global PCI/MSI domain hwsize is MSI_XA_DOMAIN_SIZE, so
nothing bounds the request.

Cap num_msix_usable with pci_msix_vec_count().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.