CVE-2026-97990 vdpa_sim_net: check TX pull result before RX copy
A missing check in the Linux kernel's vdpa_sim_net driver allows negative error codes to become large lengths, potentially causing memory corruption or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97990?
CVE-2026-97990 is a high-severity vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vdpa_sim_net: check TX pull result before RX copy
vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path.
Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes.
I found this bug myself, though the patch was written with AI assistance.
Which versions are affected by CVE-2026-97990?
How do I fix CVE-2026-97990?
Apply the vendor's patch.
Is CVE-2026-97990 being exploited?
There is no known exploitation of CVE-2026-97990 in the wild and no public exploit code.
Sources
Also known as AZL-104775, BELL-CVE-2026-97990, DEBIAN-CVE-2026-97990, GHSA-w85p-r6cx-8whc, UBUNTU-CVE-2026-97990.