CVE-2026-74404

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one<br /> <br /> Sashiko notes:<br /> <br /> &gt; regarding the bounds check in snp_filter_reserved_mem_regions()<br /> &gt; called via walk_iomem_res_desc(): does the check<br /> &gt; if ((range_list-&gt;num_elements * 16 + 8) &gt; PAGE_SIZE)<br /> &gt; allow an off-by-one heap buffer overflow?<br /> &gt;<br /> &gt; If range_list-&gt;num_elements is 255, 255 * 16 + 8 = 4088, which is Writing range-&gt;base (8 bytes) fills 4088-4095, but writing range-&gt;page_count<br /> &gt; (4 bytes) would write to 4096-4099, overflowing the kzalloc-allocated<br /> &gt; PAGE_SIZE buffer.<br /> <br /> Fix this by accounting for the entry about to be written to, in addition to<br /> the entries that are already allocated.