CVE-2026-90314

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the remoteproc component due to the use of a signed offset in the rsc table for each entry() function. The table->offset[i] value, provided as a u32 from firmware, is stored as a signed integer. A specially crafted offset can be interpreted as a negative value, causing the pointer to reference memory before the table buffer. This bypasses availability checks because the negative integer is promoted to a large size t during the calculation of table sz - offset - sizeof(*hdr), allowing an unauthorized read of hdr->type to occur.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.