In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so reject them before the user-controlled allocation reaches kcalloc(). Use a subtraction-based check while holding gref_mutex so adding the requested count cannot wrap. Also cast the count before advancing the per-file index so the page-size multiplication is performed in 64-bit arithmetic.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/2299822f3f466b5dcad2377bf63986199f881a6b cve-icon cve-icon
https://git.kernel.org/stable/c/231542f4e43cf9837cb520664545e85fbe666b7b cve-icon cve-icon
https://git.kernel.org/stable/c/641de086a05f349de7fc548612432bc2fed721ca cve-icon cve-icon
https://git.kernel.org/stable/c/71a0cf87e19fb35c4292ca88985e376e613c900a cve-icon cve-icon
https://git.kernel.org/stable/c/720554c04acba80018ded069d3e0984bebaee891 cve-icon cve-icon
https://git.kernel.org/stable/c/84d5727cef8eb9c8a28210ad248f1c70b223b065 cve-icon cve-icon
https://git.kernel.org/stable/c/e2806390aa1c4d5b3f7a68f10a56ae12c71c00d8 cve-icon cve-icon
History

Fri, 23 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux linux
Vendors & Products Linux linux

Fri, 23 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-400
CWE-680

Fri, 23 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so reject them before the user-controlled allocation reaches kcalloc(). Use a subtraction-based check while holding gref_mutex so adding the requested count cannot wrap. Also cast the count before advancing the per-file index so the page-size multiplication is performed in 64-bit arithmetic.
Title xen/gntalloc: validate grant count before allocation
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T11:54:10.566Z

Updated: 2026-10-23T11:54:10.566Z

Reserved: 2026-09-25T10:25:14.379Z

Link: CVE-2026-98900

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T12:18:24.020

Modified: 2026-10-23T12:18:24.020

Link: CVE-2026-98900

cve-icon Redhat

No data.