Out-of-bounds read in Linux kernel - CVE-2026-90416
Published: September 18, 2026
Vulnerability identifier: #VU151063
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90416
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the get_param() function of the cc_params debugfs interface when reading a congestion parameter. A local user can read a crafted congestion parameter value through the debugfs interface to disclose sensitive information.
The issue is triggered when the parameter value has bit 31 set.
Affected software
Linux kernel
How to mitigate CVE-2026-90416
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/03826bc1fa6c90405bf05831f2b501a8368dcd27
- https://git.kernel.org/stable/c/06b62758f81e27ca4c81201c22e3436c6d9ac894
- https://git.kernel.org/stable/c/0b0122fcc923a0271130f5fb71af2cd7e20434d9
- https://git.kernel.org/stable/c/1c5b4f76cd73372c5a8a4c91c95d5a31f141e091
- https://git.kernel.org/stable/c/4599311e78e88c893ad551aca622de2bfdf1c31f
- https://git.kernel.org/stable/c/c75ee076fa09778a2f9602a972dade4a0b0785f7
- https://git.kernel.org/stable/c/ce8dfd32a33b578c3abf178f67b4c8d36854f041
- https://git.kernel.org/stable/c/d809cf3f0ed9255abfc73c4730bcf187151422af