{"id":"CVE-2026-74404","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one\n\nSashiko notes:\n\n> regarding the bounds check in snp_filter_reserved_mem_regions()\n> called via walk_iome…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one\n\nSashiko notes:\n\n> regarding the bounds check in snp_filter_reserved_mem_regions()\n> called via walk_iome…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < 830c1f3e71989448652973375ef5e39b6ede47a3","Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < c5c79d92da0f9a09f48be5e2aabed2d6d1a96294","Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < af7341616b742ad2c374a90998bd650a035f694d","Linux >= 1ca5614b84eed5904f65f143e0e7aaab0ac4c6b2 < 1b864b6cb213bbd7b406e9b2e98c962077f300df","Linux 6.9"],"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:17:25.707","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74404","references":[{"url":"https://git.kernel.org/stable/c/1b864b6cb213bbd7b406e9b2e98c962077f300df","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/830c1f3e71989448652973375ef5e39b6ede47a3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af7341616b742ad2c374a90998bd650a035f694d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c5c79d92da0f9a09f48be5e2aabed2d6d1a96294","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00189,"epssPercentile":0.08484,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:55:44.374861Z"},"ingestedAt":"2026-10-16T19:46:24.368Z","slug":"CVE-2026-74404","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one\n\nSashiko notes:\n\n> regarding the bounds check in snp_filter_reserved_mem_regions()\n> called via walk_iomem_res_desc(): does the check\n> if ((range_list->num_elements * 16 + 8) > PAGE_SIZE)\n> allow an off-by-one heap buffer overflow?\n>\n> If range_list->num_elements is 255, 255 * 16 + 8 = 4088, which is <= 4096.\n> Writing range->base (8 bytes) fills 4088-4095, but writing range->page_count\n> (4 bytes) would write to 4096-4099, overflowing the kzalloc-allocated\n> PAGE_SIZE buffer.\n\nFix this by accounting for the entry about to be written to, in addition to\nthe entries that are already allocated.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}