CVE-2026-98900

xen/gntalloc: validate grant count before allocation

State: Published
Severity: Not scored
Published: Oct 23, 2026
Updated: Oct 26, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xen/gntalloc: validate grant count before allocation

gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so reject them before the user-controlled allocation reaches kcalloc().

Use a subtraction-based check while holding gref_mutex so adding the requested count cannot wrap. Also cast the count before advancing the per-file index so the page-size multiplication is performed in 64-bit arithmetic.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	dd3140588d9551235ebc2a0dacdca098e7677573 to before e2806390aa1c4d5b3f7a68f10a56ae12c71c00d8Affected dd3140588d9551235ebc2a0dacdca098e7677573 to before 71a0cf87e19fb35c4292ca88985e376e613c900aAffected dd3140588d9551235ebc2a0dacdca098e7677573 to before 641de086a05f349de7fc548612432bc2fed721caAffected dd3140588d9551235ebc2a0dacdca098e7677573 to before 720554c04acba80018ded069d3e0984bebaee891Affected dd3140588d9551235ebc2a0dacdca098e7677573 to before 84d5727cef8eb9c8a28210ad248f1c70b223b065Affected dd3140588d9551235ebc2a0dacdca098e7677573 to before 231542f4e43cf9837cb520664545e85fbe666b7bAffected dd3140588d9551235ebc2a0dacdca098e7677573 to before 2299822f3f466b5dcad2377bf63986199f881a6bAffected
LinuxLinux	2.6.39Affected before 2.6.39Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

dd3140588d9551235ebc2a0dacdca098e7677573 to before e2806390aa1c4d5b3f7a68f10a56ae12c71c00d8Affected
dd3140588d9551235ebc2a0dacdca098e7677573 to before 71a0cf87e19fb35c4292ca88985e376e613c900aAffected
dd3140588d9551235ebc2a0dacdca098e7677573 to before 641de086a05f349de7fc548612432bc2fed721caAffected
dd3140588d9551235ebc2a0dacdca098e7677573 to before 720554c04acba80018ded069d3e0984bebaee891Affected
dd3140588d9551235ebc2a0dacdca098e7677573 to before 84d5727cef8eb9c8a28210ad248f1c70b223b065Affected
dd3140588d9551235ebc2a0dacdca098e7677573 to before 231542f4e43cf9837cb520664545e85fbe666b7bAffected
dd3140588d9551235ebc2a0dacdca098e7677573 to before 2299822f3f466b5dcad2377bf63986199f881a6bAffected

LinuxLinux

2.6.39Affected
before 2.6.39Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.