Not yet scoredPublished Oct 23, 2026

CVE-2026-98900xen/gntalloc: validate grant count before allocation

Updated under an hour ago (Oct 27, 2026, 7:23 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so reject them before the user-controlled allocation reaches kcalloc(). Use a subtraction-based check while holding gref_mutex so adding the requested count cannot wrap. Also cast the count before advancing the per-file index so the page-size multiplication is performed in 64-bit arithmetic.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 23, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from dd3140588d9551235ebc2a0dacdca098e7677573 before e2806390aa1c4d5b3f7a68f10a56ae12c71c00d8; from dd3140588d9551235ebc2a0dacdca098e7677573 before 71a0cf87e19fb35c4292ca88985e376e613c900a; from dd3140588d9551235ebc2a0dacdca098e7677573 before 641de086a05f349de7fc548612432bc2fed721ca; from dd3140588d9551235ebc2a0dacdca098e7677573 before 720554c04acba80018ded069d3e0984bebaee891; from dd3140588d9551235ebc2a0dacdca098e7677573 before 84d5727cef8eb9c8a28210ad248f1c70b223b065; from dd3140588d9551235ebc2a0dacdca098e7677573 before 231542f4e43cf9837cb520664545e85fbe666b7b; from dd3140588d9551235ebc2a0dacdca098e7677573 before 2299822f3f466b5dcad2377bf63986199f881a6b	CNA record

References

References

https://git.kernel.org/stable/c/e2806390aa1c4d5b3f7a68f10a56ae12c71c00d8
https://git.kernel.org/stable/c/71a0cf87e19fb35c4292ca88985e376e613c900a
https://git.kernel.org/stable/c/641de086a05f349de7fc548612432bc2fed721ca
https://git.kernel.org/stable/c/720554c04acba80018ded069d3e0984bebaee891
https://git.kernel.org/stable/c/84d5727cef8eb9c8a28210ad248f1c70b223b065
https://git.kernel.org/stable/c/231542f4e43cf9837cb520664545e85fbe666b7b
https://git.kernel.org/stable/c/2299822f3f466b5dcad2377bf63986199f881a6b

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.