{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97906", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.200Z", "datePublished": "2026-09-25T10:22:31.640Z", "dateUpdated": "2026-10-21T12:53:32.335Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:53:32.335Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbootconfig: Fix integer overflow in initrd size check\n\nSashiko reported that in get_boot_config_from_initrd(), a crafted initrd\nwith a huge bootconfig size (such as 0xFFFFFFFF) can cause the pointer\narithmetic:\n\n data = ((void *)hdr) - size;\n\nto wrap around on 32-bit systems (or when pointer subtraction overflows).\nBecause data wraps around, the subsequent bounds check:\n\n if ((unsigned long)data < initrd_start)\n\nevaluates to false, bypassing the check. The kernel then calls\nxbc_calc_checksum(data, size), which attempts to read 4GB of memory,\nhitting unmapped pages and triggering a fatal kernel page fault during\nearly boot. Furthermore, on 64-bit systems with an initrd > 4.29 GB, an\nunbounded 32-bit size can similarly bypass the initrd_start check.\n\nFix this by:\n1. Ensuring the initrd is at least large enough to contain the bootconfig\n footer and verifying hdr is within the initrd bounds.\n2. Checking that size does not exceed XBC_DATA_MAX and does not exceed\n the available space between initrd_start and hdr before performing\n pointer subtraction."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["init/main.c"], "versions": [{"version": "de462e5f10718517bacf2f84c8aa2804567ef7df", "lessThan": "97be05f33f79342ea65d9b99c9ad07a93b8eef5a", "status": "affected", "versionType": "git"}, {"version": "de462e5f10718517bacf2f84c8aa2804567ef7df", "lessThan": "4d45bc0f8cdf606d5409b5f64a8a6609f6520c03", "status": "affected", "versionType": "git"}, {"version": "de462e5f10718517bacf2f84c8aa2804567ef7df", "lessThan": "8d4343a411eaa182d323ab5b149496416015f27d", "status": "affected", "versionType": "git"}, {"version": "de462e5f10718517bacf2f84c8aa2804567ef7df", "lessThan": "bff9a1579e2c9b2a59fdf3793becc9d7bf5ff1a6", "status": "affected", "versionType": "git"}, {"version": "de462e5f10718517bacf2f84c8aa2804567ef7df", "lessThan": "7812d6dab0698001e50e8c2f901e17da3eb6f429", "status": "affected", "versionType": "git"}, {"version": "32394df25d8e46935b442b429d74b37885c4f092", "status": "affected", "versionType": "git"}, {"version": "5.6.14", "lessThan": "5.7", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["init/main.c"], "versions": [{"version": "5.7", "status": "affected"}, {"version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/97be05f33f79342ea65d9b99c9ad07a93b8eef5a"}, {"url": "https://git.kernel.org/stable/c/4d45bc0f8cdf606d5409b5f64a8a6609f6520c03"}, {"url": "https://git.kernel.org/stable/c/8d4343a411eaa182d323ab5b149496416015f27d"}, {"url": "https://git.kernel.org/stable/c/bff9a1579e2c9b2a59fdf3793becc9d7bf5ff1a6"}, {"url": "https://git.kernel.org/stable/c/7812d6dab0698001e50e8c2f901e17da3eb6f429"}], "title": "bootconfig: Fix integer overflow in initrd size check", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["init/main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "97be05f33f79342ea65d9b99c9ad07a93b8eef5a", "status": "affected", "version": "de462e5f10718517bacf2f84c8aa2804567ef7df", "versionType": "git"}, {"lessThan": "4d45bc0f8cdf606d5409b5f64a8a6609f6520c03", "status": "affected", "version": "de462e5f10718517bacf2f84c8aa2804567ef7df", "versionType": "git"}, {"lessThan": "8d4343a411eaa182d323ab5b149496416015f27d", "status": "affected", "version": "de462e5f10718517bacf2f84c8aa2804567ef7df", "versionType": "git"}, {"lessThan": "bff9a1579e2c9b2a59fdf3793becc9d7bf5ff1a6", "status": "affected", "version": "de462e5f10718517bacf2f84c8aa2804567ef7df", "versionType": "git"}, {"lessThan": "7812d6dab0698001e50e8c2f901e17da3eb6f429", "status": "affected", "version": "de462e5f10718517bacf2f84c8aa2804567ef7df", "versionType": "git"}, {"status": "affected", "version": "32394df25d8e46935b442b429d74b37885c4f092", "versionType": "git"}, {"lessThan": "5.7", "status": "affected", "version": "5.6.14", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["init/main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.7"}, {"lessThan": "5.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbootconfig: Fix integer overflow in initrd size check\n\nSashiko reported that in get_boot_config_from_initrd(), a crafted initrd\nwith a huge bootconfig size (such as 0xFFFFFFFF) can cause the pointer\narithmetic:\n\n data = ((void *)hdr) - size;\n\nto wrap around on 32-bit systems (or when pointer subtraction overflows).\nBecause data wraps around, the subsequent bounds check:\n\n if ((unsigned long)data < initrd_start)\n\nevaluates to false, bypassing the check. The kernel then calls\nxbc_calc_checksum(data, size), which attempts to read 4GB of memory,\nhitting unmapped pages and triggering a fatal kernel page fault during\nearly boot. Furthermore, on 64-bit systems with an initrd > 4.29 GB, an\nunbounded 32-bit size can similarly bypass the initrd_start check.\n\nFix this by:\n1. Ensuring the initrd is at least large enough to contain the bootconfig\n footer and verifying hdr is within the initrd bounds.\n2. Checking that size does not exceed XBC_DATA_MAX and does not exceed\n the available space between initrd_start and hdr before performing\n pointer subtraction."}], "id": "CVE-2026-97906", "lastModified": "2026-10-21T13:21:15.433", "metrics": {}, "published": "2026-09-25T11:17:17.517", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4d45bc0f8cdf606d5409b5f64a8a6609f6520c03"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7812d6dab0698001e50e8c2f901e17da3eb6f429"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8d4343a411eaa182d323ab5b149496416015f27d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/97be05f33f79342ea65d9b99c9ad07a93b8eef5a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bff9a1579e2c9b2a59fdf3793becc9d7bf5ff1a6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bootconfig: Fix integer overflow in initrd size check", "id": "2541104", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541104"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbootconfig: Fix integer overflow in initrd size check\nSashiko reported that in get_boot_config_from_initrd(), a crafted initrd\nwith a huge bootconfig size (such as 0xFFFFFFFF) can cause the pointer\narithmetic:\ndata = ((void *)hdr) - size;\nto wrap around on 32-bit systems (or when pointer subtraction overflows).\nBecause data wraps around, the subsequent bounds check:\nif ((unsigned long)data < initrd_start)\nevaluates to false, bypassing the check. The kernel then calls\nxbc_calc_checksum(data, size), which attempts to read 4GB of memory,\nhitting unmapped pages and triggering a fatal kernel page fault during\nearly boot. Furthermore, on 64-bit systems with an initrd > 4.29 GB, an\nunbounded 32-bit size can similarly bypass the initrd_start check.\nFix this by:\n1. Ensuring the initrd is at least large enough to contain the bootconfig\nfooter and verifying hdr is within the initrd bounds.\n2. Checking that size does not exceed XBC_DATA_MAX and does not exceed\nthe available space between initrd_start and hdr before performing\npointer subtraction.", "A flaw was found in the Linux kernel. A local attacker with the ability to supply a crafted initial RAM disk (initrd) can trigger an integer overflow during boot configuration parsing. This flaw allows the attacker to bypass memory bounds checks, causing the system to read unmapped memory and crash during early boot, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-97906", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97906\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97906\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97906.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de462e5f10718517bacf2f84c8aa2804567ef7df,8d4343a411eaa182d323ab5b149496416015f27d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de462e5f10718517bacf2f84c8aa2804567ef7df,bff9a1579e2c9b2a59fdf3793becc9d7bf5ff1a6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de462e5f10718517bacf2f84c8aa2804567ef7df,7812d6dab0698001e50e8c2f901e17da3eb6f429)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "32394df25d8e46935b442b429d74b37885c4f092"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.6.14,5.7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T14:30:14.460440+00:00", "updated": "2026-10-01T09:00:05.481684+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}