{"id":29146,"date":"2026-09-25T20:31:58","date_gmt":"2026-09-25T12:31:58","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97990"},"modified":"2026-09-25T20:31:58","modified_gmt":"2026-09-25T12:31:58","slug":"cve-2026-97990","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97990","title":{"rendered":"CVE-2026-97990 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim_net: check T"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>vdpa_sim_net: check TX pull result before RX copy<\/p>\n<p>vringh_iov_pull_iotlb() returns a signed byte count.  A failed TX pull is<br \/>\ncurrently added to the unsigned byte counter and then passed as a size_t<br \/>\nlength to receive_filter() and vringh_iov_push_iotlb().  A negative error<br \/>\ncan therefore become a large length in the RX path.<\/p>\n<p>Handle non-positive pull results before every length use.  Count the TX<br \/>\nerror and complete the consumed TX descriptor with zero bytes.<\/p>\n<p>I found this bug myself, though the patch was written with AI assistance.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>vdpa_sim_net: check TX pull result before RX copy<\/p>\n<p>vringh_iov_pull_iotlb() returns a signed byte count.  A failed TX pull is<br \/>\ncurren<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29146","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}