All vulnerabilities
CVE-2026-98900

Linux: xen/gntalloc: validate grant count before allocation

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in71a0cf87e19fb35c4292ca88985e376e613c900aAlso 641de086a05f349de7fc548612432bc2fed721ca, 720554c04acba80018ded069d3e0984bebaee891 and 9 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 71a0cf87e19fb35c4292ca88985e376e613c900aLinuxCVE List
  • 641de086a05f349de7fc548612432bc2fed721caLinuxCVE List
  • 720554c04acba80018ded069d3e0984bebaee891LinuxCVE List
  • 84d5727cef8eb9c8a28210ad248f1c70b223b065LinuxCVE List
  • 231542f4e43cf9837cb520664545e85fbe666b7bLinuxCVE List
  • 2299822f3f466b5dcad2377bf63986199f881a6bLinuxCVE List
Show all 12 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

xen/gntalloc: validate grant count before allocation

gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so reject them before the user-controlled allocation reaches kcalloc().

Use a subtraction-based check while holding gref_mutex so adding the requested count cannot wrap. Also cast the count before advancing the per-file index so the page-size multiplication is performed in 64-bit arithmetic.

Text from CVE List

Affected versions 20

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before e2806390aa1c4d5b3f7a68f10a56ae12c71c00d8CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 71a0cf87e19fb35c4292ca88985e376e613c900aCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 641de086a05f349de7fc548612432bc2fed721caCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 720554c04acba80018ded069d3e0984bebaee891CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 84d5727cef8eb9c8a28210ad248f1c70b223b065CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 231542f4e43cf9837cb520664545e85fbe666b7bCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2299822f3f466b5dcad2377bf63986199f881a6bCVE List
  • Linuxaffected: all versions before 5.10.271CVE List
  • Linuxaffected: all versions before 5.15.222CVE List
  • Linuxaffected: all versions before 6.1.189CVE List
  • Linuxaffected: all versions before 6.6.158CVE List
  • Linuxaffected: all versions before 6.12.111CVE List
  • Linuxaffected: all versions before 6.18.53CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 7