CVE-2026-74404: crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one
In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - Fix snpfilterreservedmemregions() off-by-one
Sashiko notes:
> regarding the bounds check in snpfilterreservedmemregions() > called via walkiomemresdesc(): does the check > if ((rangelist->numelements 16 + 8) > PAGESIZE) > allow an off-by-one heap buffer overflow? > > If rangelist->numelements is 255, 255 16 + 8 = 4088, which is <= 4096. > Writing range->base (8 bytes) fills 4088-4095, but writing range->pagecount > (4 bytes) would write to 4096-4099, overflowing the kzalloc-allocated > PAGESIZE buffer.
Fix this by accounting for the entry about to be written to, in addition to the entries that are already allocated.