Off-by-One Heap Buffer Overflow in Linux Kernel's Crypto Subsystem

CVE-2026-74404

What is CVE-2026-74404?

A vulnerability in the Linux kernel's crypto subsystem has been identified due to an off-by-one condition in the snp_filter_reserved_mem_regions() function. This occurs when checking the bounds of memory allocation based on the number of elements intended to be processed. An attacker exploiting this vulnerability could potentially write beyond the allocated heap buffer, leading to memory corruption and unauthorized access. The issue arises when the total calculated size (range_list->num_elements * 16 + 8) incorrectly allows a write operation to exceed the defined PAGE_SIZE limit. The fix involves correcting the bounds check to ensure proper memory allocation and mitigate the risk of buffer overflows.

References