Executive brief
The Linux kernel's remoteproc subsystem (used to manage auxiliary processor cores) contained an out-of-bounds memory read vulnerability in resource table processing. A malicious or corrupted firmware image could craft a specially-designed offset value that causes the kernel to read kernel memory outside the intended buffer, potentially exposing sensitive information from kernel memory.
Technical details
The vulnerability exists in the rsc_table_for_each_entry() function in include/linux/rsc_table.h. A firmware-supplied u32 offset value was incorrectly cast to a signed int, allowing large unsigned values (e.g., 0xFFFFFFF0) to become negative integers (e.g., -16). During pointer arithmetic, the negative offset would point before the table buffer. The subsequent bounds check comparing "table_sz - offset - sizeof(*hdr)" failed because the negative int was promoted to a large unsigned size_t, bypassing validation. The fix stores the offset as unsigned (u32) and performs unsigned comparisons before any pointer arithmetic, preventing negative offset values from being used.
Affected products
- Linux Linux kernel multiple versions affected; patch available in stable series
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched