CVE-2026-90314

A flaw was found in the Linux kernel's remoteproc component. This vulnerability allows a local attacker to trigger an out-of-bounds read by providing a specially crafted offset from firmware. The issue arises because a 32-bit unsigned integer offset is incorrectly handled as a signed integer, leading to a negative value that bypasses a crucial size check. This can result in information disclosure, potentially allowing an attacker to gain access to sensitive data.

A moderate out-of-bounds read flaw was found in the Linux kernel's remoteproc subsystem, affecting the kernel packages in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. When iterating a firmware resource table, rsc_table_for_each_entry() stored a 32-bit unsigned offset from firmware into a signed int; a crafted offset such as 0xFFFFFFF0 becomes a negative value that places the entry header before the table buffer and bypasses the bounds check, because the negative int is promoted to a large size_t in the available-size computation. A local attacker able to load specially crafted remoteproc firmware could use this flaw to trigger an out-of-bounds read, which may expose sensitive kernel memory contents and can crash the kernel, resulting in a denial of service. Red Hat rated this flaw Moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting the local attack vector and the primary availability impact. Earlier Red Hat Enterprise Linux versions (including the RHEL 6, 7, 8, and 9 kernel and kernel-rt packages) and the OpenShift Container Platform RHEL CoreOS images are not affected because the vulnerable code is not present in those kernels. For the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS streams the fix is deferred to a future planned update; the residual risk is considered limited because exploitation requires local access to the system together with the ability to supply crafted remoteproc firmware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.