{"cve":"CVE-2026-97990","nvd":{"published":"2026-09-25T11:17:27.113","modified":"2026-10-19T10:17:50.350","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim_net: check TX pull result before RX copy\n\nvringh_iov_pull_iotlb() returns a signed byte count.  A failed TX pull is\ncurrently added to the unsigned byte counter and then passed as a size_t\nlength to receive_filter() and vringh_iov_push_iotlb().  A negative error\ncan therefore become a large length in the RX path.\n\nHandle non-positive pull results before every length use.  Count the TX\nerror and complete the consumed TX descriptor with zero bytes.\n\nI found this bug myself, though the patch was written with AI assistance.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:H","score":7.5},"cwes":[],"references":["https://git.kernel.org/stable/c/0d195797a80b77f2ec56718cd26d3ee65d0093e8","https://git.kernel.org/stable/c/1b803d382cde6d85755b363f22010208a04ba40a","https://git.kernel.org/stable/c/2bbf1c1f69991e28787e02b0a2f826289d5fc730","https://git.kernel.org/stable/c/3af20238a09ca180d66623e3bed16b64e9975f39","https://git.kernel.org/stable/c/c001abcde865b74231da8f1412c3217dbf66781e"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-97990","score":0.00118,"percentile":0.01709,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}