CVE-2026-90082

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Cap MSI-X vectors to the device MSI-X table size

mana_gd_query_max_resources() sizes gc->num_msix_usable from resp.max_msix

and the CPU count, but never from the device MSI-X table. On a 1792 vCPU

M-series VM that yields 1793 while the table has 1024 entries, and

mana_gd_setup_remaining_irqs() then walks indices 1..1792, running off the

end of the region mapped by msix_map_region():

BUG: unable to handle page fault for address: ff8e347f8b99800c

RIP: 0010:msix_prepare_msi_desc+0x7a/0x90

RAX: 0000000000004000 RBX: ff4330cb164ea780 RCX: ff8e347f8b998000

Call Trace:

<TASK>

__msi_domain_alloc_irqs+0x13a/0x440

msi_domain_alloc_irq_at+0x149/0x1b0

mana_gd_setup+0x351/0x890

mana_gd_probe+0x274/0x390

</TASK>

RAX is index 1024 * PCI_MSIX_ENTRY_SIZE, one entry past the table.

msi_insert_desc() does range check the index, but only against the MSI

domain hwsize, which matches the table only

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References