CVE-2026-89596

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

forcedeth: fix off-by-one when saving/restoring non-PCI config space

nv_suspend() and nv_resume() walk the non-PCI configuration space with

for (i = 0; i <= np->register_size/sizeof(u32); i++)

which runs one iteration too many. saved_config_space is declared as

u32 saved_config_space[NV_PCI_REGSZ_MAX/4];

and NV_PCI_REGSZ_VER3 is equal to NV_PCI_REGSZ_MAX (0x604), so on a VER3

device register_size/sizeof(u32) is exactly the array length and the last

iteration addresses one element past the end.

The element it lands on is np->name_rx[0..3]: saved_config_space[] is

followed immediately by char name_rx[IFNAMSIZ + 3], and char needs no

padding. Nothing observable is corrupted by that, because nv_request_irq()

rewrites name_rx with sprintf() before it is ever passed to request_irq().

The bug is the out-of-bounds access itself, which UBSAN reports and which

CONFIG_UBSAN_TRAP=y turns into a trap that aborts the runnin

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References