PT-2026-27755 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-04-20 · CVE-2026-23390

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel tracing subsystem contains a flaw in the dma map sg tracepoint. When tracing large scatter-gather lists, the tracepoint can trigger a buffer overflow due to exceeding the PERF MAX TRACE SIZE limit of 8192 bytes. This occurs when devices, such as virtio-gpu, create large Direct Memory Access (DMA) buffers with a high number of entries (nents), potentially exceeding 1000. The overflow is caused by the dynamic arrays used to store physical addresses, DMA addresses, and lengths exceeding the allocated buffer size. The issue is addressed by limiting the size of these dynamic arrays to a maximum of 128 entries using the min() function during array size calculation. This ensures that the arrays are appropriately sized, preventing overflow while minimizing unnecessary memory allocation. The tracepoint now records the full number of entries and a flag indicating if data has been truncated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-23390

Affected Products

Linux Kernel

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23390.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-23390 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23390 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23390 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23390 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23390 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23390 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23390 · Vendor Advisory
• https://git.kernel.org/stable/c/daafcc0ef0b358d9d622b6e3b7c43767aa3814ee · Patch
• https://git.kernel.org/stable/c/f2584f791a10343bdc995ff6ff402db45b95de69 · Patch
• https://git.kernel.org/stable/c/02d209bb018a40dee9eac89e91860253dee9605b · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-23390 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23390 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-23390 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note