---
id: CVE-2026-97990
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vdpa_sim_net: check TX pull result before RX copy

  vringh_iov_pull_iotlb() returns a signed byte count
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vdpa_sim_net: check TX pull result before RX copy

  vringh_iov_pull_iotlb() returns a signed byte count.  A failed TX pull is
  currently added to the unsigned byte counte…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= cfe226892913a448e83e7a19db93862baa3cb99c <
    c001abcde865b74231da8f1412c3217dbf66781e
  - >-
    Linux >= cfe226892913a448e83e7a19db93862baa3cb99c <
    3af20238a09ca180d66623e3bed16b64e9975f39
  - >-
    Linux >= cfe226892913a448e83e7a19db93862baa3cb99c <
    2bbf1c1f69991e28787e02b0a2f826289d5fc730
  - >-
    Linux >= cfe226892913a448e83e7a19db93862baa3cb99c <
    0d195797a80b77f2ec56718cd26d3ee65d0093e8
  - Linux 5.19
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T15:18:03.340'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97990'
references:
  - url: 'https://git.kernel.org/stable/c/0d195797a80b77f2ec56718cd26d3ee65d0093e8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2bbf1c1f69991e28787e02b0a2f826289d5fc730'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3af20238a09ca180d66623e3bed16b64e9975f39'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c001abcde865b74231da8f1412c3217dbf66781e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.865Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vdpa_sim_net: check TX pull result before RX copy

vringh_iov_pull_iotlb() returns a signed byte count.  A failed TX pull is
currently added to the unsigned byte counter and then passed as a size_t
length to receive_filter() and vringh_iov_push_iotlb().  A negative error
can therefore become a large length in the RX path.

Handle non-positive pull results before every length use.  Count the TX
error and complete the consumed TX descriptor with zero bytes.

I found this bug myself, though the patch was written with AI assistance.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.