CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's vdpa_sim_net component, where improper handling of transmission (TX) pull results can lead to incorrect byte counts being processed in the receive (RX) path. This flaw may allow negative error values to be interpreted as large lengths, potentially leading to memory corruption or denial of service. Organizations using affected Linux kernel versions should prioritize patching to mitigate potential exploitation risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_net: check TX pull result before RX copy vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path. Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes. I found this bug myself, though the patch was written with AI assistance.