{"id":"CVE-2026-74404","summary":"crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one\n\nSashiko notes:\n\n\u003e regarding the bounds check in snp_filter_reserved_mem_regions()\n\u003e called via walk_iomem_res_desc(): does the check\n\u003e if ((range_list-\u003enum_elements * 16 + 8) \u003e PAGE_SIZE)\n\u003e allow an off-by-one heap buffer overflow?\n\u003e\n\u003e If range_list-\u003enum_elements is 255, 255 * 16 + 8 = 4088, which is \u003c= 4096.\n\u003e Writing range-\u003ebase (8 bytes) fills 4088-4095, but writing range-\u003epage_count\n\u003e (4 bytes) would write to 4096-4099, overflowing the kzalloc-allocated\n\u003e PAGE_SIZE buffer.\n\nFix this by accounting for the entry about to be written to, in addition to\nthe entries that are already allocated.","modified":"2026-08-18T03:56:57.533639117Z","published":"2026-08-15T05:59:14.073Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74404.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1b864b6cb213bbd7b406e9b2e98c962077f300df"},{"type":"WEB","url":"https://git.kernel.org/stable/c/830c1f3e71989448652973375ef5e39b6ede47a3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/af7341616b742ad2c374a90998bd650a035f694d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c5c79d92da0f9a09f48be5e2aabed2d6d1a96294"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74404.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74404"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2"},{"fixed":"830c1f3e71989448652973375ef5e39b6ede47a3"},{"fixed":"c5c79d92da0f9a09f48be5e2aabed2d6d1a96294"},{"fixed":"af7341616b742ad2c374a90998bd650a035f694d"},{"fixed":"1b864b6cb213bbd7b406e9b2e98c962077f300df"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74404.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.9.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74404.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}