{"id":25491,"date":"2026-09-18T04:31:27","date_gmt":"2026-09-17T20:31:27","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90082"},"modified":"2026-09-18T04:31:27","modified_gmt":"2026-09-17T20:31:27","slug":"cve-2026-90082","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90082","title":{"rendered":"CVE-2026-90082 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Cap MSI-X"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: mana: Cap MSI-X vectors to the device MSI-X table size<\/p>\n<p>mana_gd_query_max_resources() sizes gc-&gt;num_msix_usable from resp.max_msix<br \/>\nand the CPU count, but never from the device MSI-X table. On a 1792 vCPU<br \/>\nM-series VM that yields 1793 while the table has 1024 entries, and<br \/>\nmana_gd_setup_remaining_irqs() then walks indices 1..1792, running off the<br \/>\nend of the region mapped by msix_map_region():<\/p>\n<p>  BUG: unable to handle page fault for address: ff8e347f8b99800c<br \/>\n  RIP: 0010:msix_prepare_msi_desc+0x7a\/0x90<br \/>\n  RAX: 0000000000004000 RBX: ff4330cb164ea780 RCX: ff8e347f8b998000<br \/>\n  Call Trace:<\/p>\n<p>   __msi_domain_alloc_irqs+0x13a\/0x440<br \/>\n   msi_domain_alloc_irq_at+0x149\/0x1b0<br \/>\n   mana_gd_setup+0x351\/0x890<br \/>\n   mana_gd_probe+0x274\/0x390<\/p>\n<p>RAX is index 1024 * PCI_MSIX_ENTRY_SIZE, one entry past the table.<\/p>\n<p>msi_insert_desc() does range check the index, but only against the MSI<br \/>\ndomain hwsize, which matches the table only for devices on an MSI parent<br \/>\ndomain. With a global PCI\/MSI domain hwsize is MSI_XA_DOMAIN_SIZE, so<br \/>\nnothing bounds the request.<\/p>\n<p>Cap num_msix_usable with pci_msix_vec_count().<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: mana: Cap MSI-X vectors to the device MSI-X table size<\/p>\n<p>mana_gd_query_max_resources() sizes gc-&gt;num_msix_usable from resp.max_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25491","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25491","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25491"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25491"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25491"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}