Cloudanix VulnDB

CVE-2026-98900

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A recent Linux kernel issue in handling certain virtualization memory requests could let local attackers on affected systems use up too much memory and disrupt normal operations.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability permits a user-controlled grant count to reach kcalloc in gntalloc_ioctl_alloc without first validating it against the global grant limit or preventing integer wrap, allowing oversized allocations and potential wrap in per-file index advancement.

Why it matters to the business

In Xen virtualization setups this can enable local resource exhaustion leading to kernel memory pressure, instability, or denial of service on affected hosts.

How an attack unfolds

An attacker with access to the gntalloc device supplies an excessively large grant count via ioctl; the missing pre-allocation check lets the request proceed to kcalloc before the limit is enforced.

How to fix it

Apply the upstream kernel patch that adds the subtraction-based grant count validation while holding gref_mutex and performs page-size multiplication in 64-bit arithmetic before updating the per-file index.

How to confirm the fix worked

Inspect the gntalloc_ioctl_alloc function for the added limit check and 64-bit cast; confirm the running kernel contains the commit that resolves the validation ordering.

Typical attack path

  1. Obtain local access in a Xen guest that can open the gntalloc device
  2. Invoke gntalloc_ioctl_alloc with a grant count exceeding the global limit
  3. Trigger the unchecked kcalloc and index advancement to exhaust resources

How to detect it

Review kernel logs and audit trails for repeated or oversized grant allocation attempts; look for processes invoking gntalloc ioctls with unusually large counts.

What your security team should do

  • Prioritize kernel updates containing the gntalloc validation fix within standard change windows
  • Limit untrusted local access to the gntalloc device via device permissions or SELinux policies
  • Monitor EPSS and KEV status for any future increase in observed exploitation

The record

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so reject them before the user-controlled allocation reaches kcalloc(). Use a subtraction-based check while holding gref_mutex so adding the requested count cannot wrap. Also cast the count before advancing the per-file index so the page-size multiplication is performed in 64-bit arithmetic.

Affected packages

Ecosystem Package Introduced Fixed