---
id: CVE-2026-90314
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()

  table->offset[i] is a u32 from firmware, but was stored into a signed
  int
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()

  table->offset[i] is a u32 from firmware, but was stored into a signed
  int.  A crafted offset l…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <
    0d385be8f199b349f325cf90584b47b6a044ea79
  - >-
    Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <
    cc85e0d3d3333fd5fd2d50c9a4578d209d7f2564
  - >-
    Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <
    6a01ad25aa4f3a02153cf1d112cb9b65865cd5d8
  - >-
    Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <
    c82241a9454b2d30d53b50884f94b7972ba44a5e
  - >-
    Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <
    bc4940793aaa16a9cf90063b11d6926f8014a1b7
  - >-
    Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <
    6fd220604f06c746760183df74b07384c3fdd660
  - >-
    Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <
    6282d47b24b0c98d08d02807d676a7f67b4c052e
  - >-
    Linux >= fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9 <
    bb840ea69347aff7bde5a208e7b5b180669a7656
  - Linux 3.4
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:29.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90314'
references:
  - url: 'https://git.kernel.org/stable/c/0d385be8f199b349f325cf90584b47b6a044ea79'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6282d47b24b0c98d08d02807d676a7f67b4c052e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6a01ad25aa4f3a02153cf1d112cb9b65865cd5d8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6fd220604f06c746760183df74b07384c3fdd660'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bb840ea69347aff7bde5a208e7b5b180669a7656'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bc4940793aaa16a9cf90063b11d6926f8014a1b7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c82241a9454b2d30d53b50884f94b7972ba44a5e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cc85e0d3d3333fd5fd2d50c9a4578d209d7f2564'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.825Z'
epss: 0.00221
epssPercentile: 0.11255
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()

table->offset[i] is a u32 from firmware, but was stored into a signed
int.  A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes
before the table buffer.  The subsequent avail check was bypassed
because the negative int was promoted to a large size_t in the
expression "table_sz - offset - sizeof(*hdr)", yielding a large positive
avail and letting the out-of-bounds hdr->type read proceed undetected.

Store the offset as u32 and validate it with unsigned comparisons before
any pointer arithmetic.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.