Executive brief
The forcedeth Nvidia network driver in the Linux kernel contains an off-by-one error when saving and restoring device configuration during suspend/resume cycles. This causes out-of-bounds memory access that corrupts adjacent kernel structures and can crash the system when safety checks are enabled, potentially allowing attackers to trigger denial of service.
Technical details
The vulnerability is a classic off-by-one array access in the nv_suspend() and nv_resume() functions. The loops iterate one extra time using "<=" instead of "<", causing a read/write one dword past the end of the saved_config_space array and one dword past the mapped MMIO window. The root cause: register_size/sizeof(u32) equals the array length (NV_PCI_REGSZ_MAX/4 = 385), so the loop condition allows index 385 to be accessed when the array is only 385 elements (indices 0-384). Attack vector is local and requires suspend/resume cycle. While the out-of-bounds write currently corrupts the adjacent name_rx field (later overwritten), it also writes to unmapped MMIO space, which triggers undefined behavior. CONFIG_UBSAN_TRAP=y enables a kernel trap that can abort execution. Fix: change loop condition from "<=" to "<".
Affected products
- Linux Linux kernel All versions with forcedeth driver (fixed in subsequent patch)
Timeline
- 2026-09-11: disclosed: CVE-2026-89596 published
- 2013-09: other: Issue reported on LKML by Marc Weber with proposed fix