« Volver al listado

CVE-2026-98282

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba

The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba(). While doing so, the passed in argument npages is ignored and constant value '1' is used leaving out a possible overflow as the callers can legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT cases.

Fix this by accounting for 'npages', checking for arithmetic overflow, and verifying that the entire requested range (ioba - offset + npages) does not exceed the table capacity 'size'.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98282",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "lessThan": "98d8dcc4ebd10523507d4478e148809a7771a213",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "lessThan": "9fd9c9bbb05417f468a11fb6d145d7ff61f4a868",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "lessThan": "3776bf56e06980e8a12c8c0565d9e6ac44965f03",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "lessThan": "d6a1779129d936bc1fbab80181165da544eab736",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "lessThan": "d48ceb6e1a6915c7bac4f902554a1047365cdff2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "lessThan": "0543813753ef5cfbd6fa96694f7acf783fa01af7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "lessThan": "314091243159f8e3749bc719bb129f423f72fd86",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b1af23d836f811137d504d14d4cbdd01929dec34",
              "lessThan": "0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "arch/powerpc/kernel/iommu.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.12",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "arch/powerpc/kernel/iommu.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-06T09:18:18.180",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0543813753ef5cfbd6fa96694f7acf783fa01af7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/314091243159f8e3749bc719bb129f423f72fd86",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3776bf56e06980e8a12c8c0565d9e6ac44965f03",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/98d8dcc4ebd10523507d4478e148809a7771a213",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9fd9c9bbb05417f468a11fb6d145d7ff61f4a868",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d48ceb6e1a6915c7bac4f902554a1047365cdff2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d6a1779129d936bc1fbab80181165da544eab736",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba\n\nThe commit b1af23d836f8 (\"KVM: PPC: iommu: Unify TCE checking\") unified\nIOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba().\nWhile doing so, the passed in argument npages is ignored and constant\nvalue '1' is used leaving out a possible overflow as the callers can\nlegitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT\ncases.\n\nFix this by accounting for 'npages', checking for arithmetic overflow,\nand verifying that the entire requested range (ioba - offset + npages)\ndoes not exceed the table capacity 'size'."
    }
  ],
  "lastModified": "2026-10-06T09:18:18.180",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}