CVE-2026-74404crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one Sashiko notes: > regarding the bounds check in snp_filter_reserved_mem_regions() > called via walk_iomem_res_desc(): does the check > if ((range_list->num_elements * 16 + 8) > PAGE_SIZE) > allow an off-by-one heap buffer overflow? > > If range_list->num_elements is 255, 255 * 16 + 8 = 4088, which is <= 4096. > Writing range->base (8 bytes) fills 4088-4095, but writing range->page_count > (4 bytes) would write to 4096-4099, overflowing the kzalloc-allocated > PAGE_SIZE buffer. Fix this by accounting for the entry about to be written to, in addition to the entries that are already allocated.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 before 830c1f3e71989448652973375ef5e39b6ede47a3; from 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 before c5c79d92da0f9a09f48be5e2aabed2d6d1a96294; from 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 before af7341616b742ad2c374a90998bd650a035f694d; 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 builds before 1b864b6cb213bbd7b406e9b2e98c962077f300df | CNA record |
References
- https://git.kernel.org/stable/c/830c1f3e71989448652973375ef5e39b6ede47a3
- https://git.kernel.org/stable/c/c5c79d92da0f9a09f48be5e2aabed2d6d1a96294
- https://git.kernel.org/stable/c/af7341616b742ad2c374a90998bd650a035f694d
- https://git.kernel.org/stable/c/1b864b6cb213bbd7b406e9b2e98c962077f300df
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.