Live › vulnerability › CVE-2026-98900
Go to dashboardThe Linux kernel's Xen grant-table allocator allocated a user-sized array before checking the count against the global limit, and the limit check could wrap. The fix rejects oversized counts earlier and does the page-size math in 64-bit, which blocks memory-exhaustion or overflow abuse from the ioctl path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems running Linux kernels that use the Xen gntalloc driver, typically Xen dom0 or hosts that expose /dev/xen/gntalloc. Systems without Xen or without that device node are not affected. The sources do not list fixed kernel versions.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
xen/gntalloc: validate grant count before allocation
gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so reject them before the user-controlled allocation reaches kcalloc().
Use a subtraction-based check while holding gref_mutex so adding the requested count cannot wrap. Also cast the count before advancing the per-file index so the page-size multiplication is performed in 64-bit arithmetic.
This page as .md · .json · in your agent: get_signal("CVE-2026-98900")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.