{"schema":"threatline.record/2","record":{"id":"CVE-2026-98900","aliases":[],"summary":"xen/gntalloc: validate grant count before allocation","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen/gntalloc: validate grant count before allocation\n\ngntalloc_ioctl_alloc() allocates the grant-id array before checking\nwhether the requested count fits within the global grant limit. Counts\nabove that limit cannot succeed, so reject them before the\nuser-controlled allocation reaches kcalloc().\n\nUse a subtraction-based check while holding gref_mutex so adding the\nrequested count cannot wrap. Also cast the count before advancing the\nper-file index so the page-size multiplication is performed in 64-bit\narithmetic.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98900","source_modified_at":"2026-10-23T11:54:10.566Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Linux","vendor":"Linux","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e2806390aa1c4d5b3f7a68f10a56ae12c71c00d8","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"71a0cf87e19fb35c4292ca88985e376e613c900a","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"641de086a05f349de7fc548612432bc2fed721ca","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"720554c04acba80018ded069d3e0984bebaee891","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"84d5727cef8eb9c8a28210ad248f1c70b223b065","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"231542f4e43cf9837cb520664545e85fbe666b7b","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2299822f3f466b5dcad2377bf63986199f881a6b","status":"affected","versionType":"git"},{"version":"0","lessThan":"5.10.271","status":"affected","versionType":"semver"},{"version":"0","lessThan":"5.15.222","status":"affected","versionType":"semver"},{"version":"0","lessThan":"6.1.189","status":"affected","versionType":"semver"},{"version":"0","lessThan":"6.6.158","status":"affected","versionType":"semver"},{"version":"0","lessThan":"6.12.111","status":"affected","versionType":"semver"},{"version":"0","lessThan":"6.18.53","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98900","source_modified_at":"2026-10-23T11:54:10.566Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Linux","vendor":"Linux","versions":[{"version":"5.10.271","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98900","source_modified_at":"2026-10-23T11:54:10.566Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"71a0cf87e19fb35c4292ca88985e376e613c900a","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98900","source_modified_at":"2026-10-23T11:54:10.566Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"641de086a05f349de7fc548612432bc2fed721ca","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98900","source_modified_at":"2026-10-23T11:54:10.566Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"720554c04acba80018ded069d3e0984bebaee891","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98900","source_modified_at":"2026-10-23T11:54:10.566Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"84d5727cef8eb9c8a28210ad248f1c70b223b065","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98900","source_modified_at":"2026-10-23T11:54:10.566Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"231542f4e43cf9837cb520664545e85fbe666b7b","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98900","source_modified_at":"2026-10-23T11:54:10.566Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"2299822f3f466b5dcad2377bf63986199f881a6b","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98900","source_modified_at":"2026-10-23T11:54:10.566Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"5.10.271","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98900","source_modified_at":"2026-10-23T11:54:10.566Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"5.15.222","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98900","source_modified_at":"2026-10-23T11:54:10.566Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"6.1.189","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98900","source_modified_at":"2026-10-23T11:54:10.566Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"6.6.158","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98900","source_modified_at":"2026-10-23T11:54:10.566Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"6.12.111","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98900","source_modified_at":"2026-10-23T11:54:10.566Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"6.18.53","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T11:54:10.566Z","modified_at":"2026-10-23T11:54:10.566Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98900","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T11:54:10.566Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/e2806390aa1c4d5b3f7a68f10a56ae12c71c00d8"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/71a0cf87e19fb35c4292ca88985e376e613c900a"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/641de086a05f349de7fc548612432bc2fed721ca"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/720554c04acba80018ded069d3e0984bebaee891"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/84d5727cef8eb9c8a28210ad248f1c70b223b065"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/231542f4e43cf9837cb520664545e85fbe666b7b"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/2299822f3f466b5dcad2377bf63986199f881a6b"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T11:54:10.566Z","content_hash":"7baab2b8ae8c80671b59609e0f776cfe8190d32183f898e6d89d5c768e3d4589"}}