https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 16:54:14 +0000 https://vulnerability.circl.lu/vuln/cve-2026-97990 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>vdpa_sim_net: check TX pull result before RX copy</p> <p>vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path.</p> <p>Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes.</p> <p>I found this bug myself, though the patch was written with AI assistance.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>vdpa_sim_net: check TX pull result before RX copy</p> <p>vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path.</p> <p>Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes.</p> <p>I found this bug myself, though the patch was written with AI assistance.</p> https://vulnerability.circl.lu/vuln/cve-2026-97990