CVE-2026-99164

NONE

Published: 2026-10-28

Modified: 2026-10-28

Enriched via mock

Tenable Plugin

Checking the public Tenable catalog…

AI Threat Summary

CVE-2026-99164 is a moderate vulnerability affecting the target software. Threat hunters should monitor for exploit attempts and apply vendor patches immediately.

Description

In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e ("spi: imx: support dynamic burst length for ECSPI DMA mode"), the driver allocates its private DMA TX/RX buffers with kzalloc(dma_len), where dma_len is only rounded up to 4 bytes, but maps, syncs and unmaps them with DMA_CACHE_ALIGNED_LEN(dma_len), i.e. rounded up to the cache line size. As a result, the DMA API operates on memory beyond the end of the allocation. This was observed on a custom i.MX8MP platform with an mcp251xfd CAN controller under heavy RPMSG load, as a series of refcount_t warnings triggered from rpmsg_recv_done() in virtio_rpmsg_bus: refcount_t: addition on 0; use-after-free. refcount_t: underflow; use-after-free. refcount_t: saturated; leaking memory. Leading finally to an "Unable to handle kernel paging request" oops. Reproducing this problem took between 30 minutes and roughly 30 hours under the same workload. Hardware watchpoints on the refcount of a struct rpmsg_endpoint showed it was overwritten from 2 to 1 by __pi_memcpy_generic() in the irq/155-spi2.0 thread. Additionally it was found that a "normal" rpmsg_recv_done() took 11µs +/-2µs from its kref_get to kref_put. In the error case the same sequence took about 215µs +/-10µs. Based on this, an LLM was used to identify the size mismatch fixed here. Allocate the buffers with DMA_CACHE_ALIGNED_LEN(dma_len) so they cover the full mapped length, and use the same length for dma_sync_single_for_cpu() to stay consistent with map and unmap. With this patch applied, the same workload ran for more than 200 hours without the problem reproducing.

Attack Chain

Reconnaissance

Attacker scans for vulnerable versions using version banners or PoC scanners

Initial Access

Attacker triggers CVE-2026-99164 vulnerability with a crafted request or payload

Execution

Vulnerability exploited to perform unauthorized actions on the target system

Impact

Depending on vulnerability type, attacker achieves data access, service disruption, or code execution

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application

Initial Access

Public-facing application vulnerability exploited for initial access

T1203 Exploitation for Client Execution

Execution

Vulnerability exploited to execute attacker-controlled code

Indicators of Compromise

Type	Value	Description
user_agent	`Mozilla/5.0 (compatible; exploit/1.0)`	Generic exploit scanner user agent pattern
url	`/api/vuln-endpoint?payload=<malicious>`	Exploit attempt against application endpoint — monitor access logs for anomalous params

Remediation

1. Apply vendor-supplied security patches immediately. 2. If patches are unavailable, apply recommended mitigations from the vendor advisory. 3. Enable WAF rules or IDS signatures to detect exploitation attempts. 4. Monitor logs for indicators of compromise listed above. 5. Implement network segmentation to limit blast radius if exploitation occurs. 6. Subscribe to vendor security advisories for this product.

Quick Facts

CVE ID	CVE-2026-99164
CVSS Score	N/A
Published	2026-10-28
Exploited	No
CISA KEV	No
PoC	Not public

References

External Resources

NVD Entry BleepingComputer The Hacker News