In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc_ioctl_alloc()… (CVE-2026-98900)

The Linux kernel xen/gntalloc vulnerability involved improper validation of the grant count in gntalloc_ioctl_alloc(). The function allocated the grant-id array before confirming that the requested count did not exceed the global grant limit, which could lead to excessive or invalid memory allocation. The resolution includes rejecting out-of-limit counts prior to allocation, employing a subtraction-based check while holding gref_mutex to prevent wraparound, and casting the count to 64-bit for safe arithmetic operations.

The vulnerability could allow a user to request a grant count exceeding the global limit, potentially causing improper memory allocation or resource exhaustion. This could lead to kernel instability or denial of service. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to validate the grant count before allocation, preventing counts above the global limit from proceeding. Users should apply the official kernel update that includes this patch once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.