Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-98900

xen/gntalloc: validate grant count before allocation

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 1 more
None on Exploit-DB, Metasploit or GitHub

Summary

The vulnerability affects the Linux kernel's Xen grant allocation driver (xen/gntalloc), which handles memory grant requests for Xen virtualization guests. An unprivileged user-space request with an oversized grant count could cause excessive memory allocation or integer overflow in the kernel, potentially leading to denial of service.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so reject them before the user-controlled allocation reaches kcalloc(). Use a subtraction-based check while holding gref_mutex so adding the requested count cannot wrap. Also cast the count before advancing the per-file index so the page-size multiplication is performed in 64-bit arithmetic.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. Record last updated

Affected versions

  • Linux Linux

    From dd3140588d9551235ebc2a0dacdca098e7677573 · fixed in e2806390aa1c4d5b3f7a68f10a56ae12c71c00d8; From dd3140588d9551235ebc2a0dacdca098e7677573 · fixed in 71a0cf87e19fb35c4292ca88985e376e613c900a; From dd3140588d9551235ebc2a0dacdca098e7677573 · fixed in 641de086a05f349de7fc548612432bc2fed721ca; From dd3140588d9551235ebc2a0dacdca098e7677573 · fixed in 720554c04acba80018ded069d3e0984bebaee891; From dd3140588d9551235ebc2a0dacdca098e7677573 · fixed in 84d5727cef8eb9c8a28210ad248f1c70b223b065; From dd3140588d9551235ebc2a0dacdca098e7677573 · fixed in 231542f4e43cf9837cb520664545e85fbe666b7b; From dd3140588d9551235ebc2a0dacdca098e7677573 · fixed in 2299822f3f466b5dcad2377bf63986199f881a6b

  • Linux Linux

    2.6.39

  • KernelLinux

    fixed in 5.10.271; From 5.11.0 · fixed in 5.15.222; From 5.16.0 · fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.53

References 7

git.kernel.org