{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs  get_param() reads a congestion parameter as a u32 but formats it with the signed \"%d\" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as \"-2147483648\\n\" whose full length is 12. snprintf() stores only 11 bytes yet returns 12, so simple_read_from_buffer() treats 12 bytes as valid and reads one byte past lbuf[].  Size the buffer for the widest unsigned decimal, format with \"%u\" to match the u32, and use scnprintf() so the length passed to simple_read_from_buffer() reflects the bytes actually stored.",
  "id": "DEBIAN-CVE-2026-90416",
  "modified": "2026-09-18T04:47:31.430610403Z",
  "published": "2026-09-17T17:17:45.880Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-90416"
    }
  ],
  "upstream": [
    "CVE-2026-90416"
  ]
}