CVE-2026-90314

What it actually does

Out-of-bounds read caused by casting a firmware-supplied u32 offset into a signed int, allowing negative values that bypass size validation and permit reading a header structure before the table buffer when the negative value is promoted to a large size_t in arithmetic.

Why it matters to the business

Attackers with the ability to supply malicious remote processor firmware images could read arbitrary kernel memory, potentially exposing sensitive data or enabling further privilege escalation on affected Linux systems; the low EPSS and lack of known exploitation reduce immediate urgency but kernel updates remain necessary for long-term safety.

How an attack unfolds

An attacker crafts a remoteproc resource table with a large u32 offset value that becomes negative when stored as a signed int; the subsequent pointer arithmetic and avail check produce a falsely large positive size, allowing the code to dereference and read hdr->type from memory before the table buffer without detection.

How to fix it

Update the Linux kernel to a version containing the fix that stores the offset as u32 and performs all offset validation and arithmetic with unsigned comparisons before pointer operations; apply the patch or newer mainline/stable release that resolves the signed offset handling in remoteproc.

How to confirm the fix worked

Confirm the kernel source contains the corrected rsc_table_for_each_entry() implementation that uses u32 for offsets and unsigned comparisons; rebuild, boot the updated kernel, and verify that malicious firmware tables with high-bit-set offsets no longer produce out-of-bounds reads or kernel warnings.

Typical attack path

1. Obtain ability to load or supply a remoteproc firmware image containing a crafted resource table
2. Set table->offset[i] to a value such as 0xFFFFFFF0 that becomes negative when assigned to signed int
3. Trigger rsc_table_for_each_entry() processing so the negative offset is used in pointer arithmetic
4. Bypass the unsigned size check due to promotion and perform out-of-bounds hdr->type read
5. Use the leaked data to inform further attacks or directly disclose kernel memory contents

How to detect it

Search kernel logs and remoteproc debug output for unexpected resource table parsing warnings or oops related to offset handling; examine loaded firmware images for anomalous high-bit-set offset values in resource tables; review audit logs around remoteproc device initialization for unusual table processing.

What your security team should do

• Prioritize kernel updates for any systems using remoteproc or remote processor firmware loading
• Review and restrict untrusted firmware loading paths until patches are applied
• Monitor vendor advisories for backported fixes in distribution kernels
• Audit custom or out-of-tree remoteproc drivers for similar signed/unsigned offset issues