https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 21:41:51 +0000 https://vulnerability.circl.lu/vuln/cve-2026-46289 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>lib/scatterlist: fix length calculations in extract_kvec_to_sg</p> <p>Patch series &#34;Fix bugs in extract_iter_to_sg()&#34;, v3.</p> <p>Fix bugs in the kvec and user variants of extract_iter_to_sg. This series is growing due to useful remarks made by sashiko.dev.</p> <p>The main bugs are: - The length for an sglist entry when extracting from a kvec can exceed the number of bytes in the page. This is obviously not intended. - When extracting a user buffer the sglist is temporarily used as a scratch buffer for extracted page pointers. If the sglist already contains some elements this scratch buffer could overlap with existing entries in the sglist.</p> <p>The series adds test cases to the kunit_iov_iter test that demonstrate all of these bugs. Additionally, there is a memory leak fix for the test itself.</p> <p>The bugs were orignally introduced into kernel v6.3 where the function lived in fs/netfs/iterator.c. It was later moved to lib/scatterlist.c in v6.5. Thus the actual fix is only marked for backports to v6.5+.</p> <p>This patch (of 5):</p> <p>When extracting from a kvec to a scatterlist, do not cross page boundaries. The required length was already calculated but not used as intended.</p> <p>Adjust the copied length if the loop runs out of sglist entries without extracting everything.</p> <p>While there, return immediately from extract_iter_to_sg if there are no sglist entries at all.</p> <p>A subsequent commit will add kunit test cases that demonstrat…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>lib/scatterlist: fix length calculations in extract_kvec_to_sg</p> <p>Patch series &#34;Fix bugs in extract_iter_to_sg()&#34;, v3.</p> <p>Fix bugs in the kvec and user variants of extract_iter_to_sg. This series is growing due to useful remarks made by sashiko.dev.</p> <p>The main bugs are: - The length for an sglist entry when extracting from a kvec can exceed the number of bytes in the page. This is obviously not intended. - When extracting a user buffer the sglist is temporarily used as a scratch buffer for extracted page pointers. If the sglist already contains some elements this scratch buffer could overlap with existing entries in the sglist.</p> <p>The series adds test cases to the kunit_iov_iter test that demonstrate all of these bugs. Additionally, there is a memory leak fix for the test itself.</p> <p>The bugs were orignally introduced into kernel v6.3 where the function lived in fs/netfs/iterator.c. It was later moved to lib/scatterlist.c in v6.5. Thus the actual fix is only marked for backports to v6.5+.</p> <p>This patch (of 5):</p> <p>When extracting from a kvec to a scatterlist, do not cross page boundaries. The required length was already calculated but not used as intended.</p> <p>Adjust the copied length if the loop runs out of sglist entries without extracting everything.</p> <p>While there, return immediately from extract_iter_to_sg if there are no sglist entries at all.</p> <p>A subsequent commit will add kunit test cases that demonstrat…</p> https://vulnerability.circl.lu/vuln/cve-2026-46289