{"id":"CVE-2026-90314","summary":"remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()\n\ntable-\u003eoffset[i] is a u32 from firmware, but was stored into a signed\nint.  A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes\nbefore the table buffer.  The subsequent avail check was bypassed\nbecause the negative int was promoted to a large size_t in the\nexpression \"table_sz - offset - sizeof(*hdr)\", yielding a large positive\navail and letting the out-of-bounds hdr-\u003etype read proceed undetected.\n\nStore the offset as u32 and validate it with unsigned comparisons before\nany pointer arithmetic.","modified":"2026-09-19T03:47:25.817574385Z","published":"2026-09-17T16:08:33.568Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90314.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0d385be8f199b349f325cf90584b47b6a044ea79"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6282d47b24b0c98d08d02807d676a7f67b4c052e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6a01ad25aa4f3a02153cf1d112cb9b65865cd5d8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6fd220604f06c746760183df74b07384c3fdd660"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bb840ea69347aff7bde5a208e7b5b180669a7656"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bc4940793aaa16a9cf90063b11d6926f8014a1b7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c82241a9454b2d30d53b50884f94b7972ba44a5e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cc85e0d3d3333fd5fd2d50c9a4578d209d7f2564"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90314.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90314"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"fd2c15ec1dd3c2fdfc6ff03bb9644da9d530e3b9"},{"fixed":"0d385be8f199b349f325cf90584b47b6a044ea79"},{"fixed":"cc85e0d3d3333fd5fd2d50c9a4578d209d7f2564"},{"fixed":"6a01ad25aa4f3a02153cf1d112cb9b65865cd5d8"},{"fixed":"c82241a9454b2d30d53b50884f94b7972ba44a5e"},{"fixed":"bc4940793aaa16a9cf90063b11d6926f8014a1b7"},{"fixed":"6fd220604f06c746760183df74b07384c3fdd660"},{"fixed":"6282d47b24b0c98d08d02807d676a7f67b4c052e"},{"fixed":"bb840ea69347aff7bde5a208e7b5b180669a7656"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90314.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"5.10.270"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.221"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.188"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.110"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.52"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90314.json"}}],"schema_version":"1.9.0"}