CVE-2026-31484

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31484", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.101Z", "datePublished": "2026-04-22T13:54:10.223Z", "dateUpdated": "2026-08-05T12:22:59.333Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:22:59.333Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/fdinfo: fix OOB read in SQE_MIXED wrap check\n\n__io_uring_show_fdinfo() iterates over pending SQEs and, for 128-byte\nSQEs on an IORING_SETUP_SQE_MIXED ring, needs to detect when the second\nhalf of the SQE would be past the end of the sq_sqes array. The current\ncheck tests (++sq_head & sq_mask) == 0, but sq_head is only incremented\nwhen a 128-byte SQE is encountered, not on every iteration. The actual\narray index is sq_idx = (i + sq_head) & sq_mask, which can be sq_mask\n(the last slot) while the wrap check passes.\n\nFix by checking sq_idx directly. Keep the sq_head increment so the loop\nstill skips the second half of the 128-byte SQE on the next iteration."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached locally by creating an io_uring instance and reading its procfs fdinfo entry; there is no network or adjacent attack surface.\nAC:L - The attacker controls the ring setup flags, SQ tail, SQ array mapping, and 128-byte SQE opcode needed to place a mixed SQE at the last physical slot. No race or external timing condition is required, and transient lock contention can be retried.\nPR:L - A normal unprivileged local user can use io_uring when the default io_uring sysctl allows it and can read /proc/self/fdinfo for its own fd. No real root or init-namespace capability is required.\nUI:N - The attacker triggers the bug by reading their own fdinfo file. No victim action is needed.\nS:U - The issue is a local kernel memory access bug within the same kernel security authority. It does not cross a VM, IOMMU, or other separate security scope boundary.\nC:H - The bug prints the second half of a 128-byte SQE by dereferencing up to 64 bytes past the SQE array, exposing adjacent kernel memory through procfs. The leak is attacker-triggerable and repeatable, so the highest defensible confidentiality impact is high.\nI:N - The vulnerable operation is an out-of-bounds read used for fdinfo printing and does not write to kernel memory or directly modify protected state.\nA:H - The same out-of-bounds kernel dereference can cross the end of the SQE allocation or a vmap-backed region and fault/oops depending on allocation layout. An unprivileged attacker can repeatedly trigger the path, so availability impact is high."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/fdinfo.c"], "versions": [{"version": "1cba30bf9fdd6c982708f3587f609a30c370d889", "lessThan": "ba21ab247a5be5382da7464b95afbe5f0e9aa503", "status": "affected", "versionType": "git"}, {"version": "1cba30bf9fdd6c982708f3587f609a30c370d889", "lessThan": "5170efd9c344c68a8075dcb8ed38d3f8a60e7ed4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["io_uring/fdinfo.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ba21ab247a5be5382da7464b95afbe5f0e9aa503"}, {"url": "https://git.kernel.org/stable/c/5170efd9c344c68a8075dcb8ed38d3f8a60e7ed4"}], "title": "io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["io_uring/fdinfo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ba21ab247a5be5382da7464b95afbe5f0e9aa503", "status": "affected", "version": "1cba30bf9fdd6c982708f3587f609a30c370d889", "versionType": "git"}, {"lessThan": "5170efd9c344c68a8075dcb8ed38d3f8a60e7ed4", "status": "affected", "version": "1cba30bf9fdd6c982708f3587f609a30c370d889", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["io_uring/fdinfo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5054C854-C253-4020-BD2E-2BDA121E424C", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*", "matchCriteriaId": "35C8A871-4971-433E-A046-FC9F7B7D190A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/fdinfo: fix OOB read in SQE_MIXED wrap check\n\n__io_uring_show_fdinfo() iterates over pending SQEs and, for 128-byte\nSQEs on an IORING_SETUP_SQE_MIXED ring, needs to detect when the second\nhalf of the SQE would be past the end of the sq_sqes array. The current\ncheck tests (++sq_head & sq_mask) == 0, but sq_head is only incremented\nwhen a 128-byte SQE is encountered, not on every iteration. The actual\narray index is sq_idx = (i + sq_head) & sq_mask, which can be sq_mask\n(the last slot) while the wrap check passes.\n\nFix by checking sq_idx directly. Keep the sq_head increment so the loop\nstill skips the second half of the 128-byte SQE on the next iteration."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nio_uring/fdinfo: correcci\u00f3n de lectura fuera de l\u00edmites en la verificaci\u00f3n de envoltura SQE_MIXED\n\n__io_uring_show_fdinfo() itera sobre los SQE pendientes y, para los SQE de 128 bytes en un anillo IORING_SETUP_SQE_MIXED, necesita detectar cu\u00e1ndo la segunda mitad del SQE estar\u00eda m\u00e1s all\u00e1 del final del array sq_sqes. La verificaci\u00f3n actual prueba (++sq_head & sq_mask) == 0, pero sq_head solo se incrementa cuando se encuentra un SQE de 128 bytes, no en cada iteraci\u00f3n. El \u00edndice real del array es sq_idx = (i + sq_head) & sq_mask, que puede ser sq_mask (la \u00faltima ranura) mientras la verificaci\u00f3n de envoltura pasa.\n\nSoluci\u00f3n al verificar sq_idx directamente. Mantener el incremento de sq_head para que el bucle a\u00fan omita la segunda mitad del SQE de 128 bytes en la siguiente iteraci\u00f3n."}], "id": "CVE-2026-31484", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-04-22T14:16:45.800", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5170efd9c344c68a8075dcb8ed38d3f8a60e7ed4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ba21ab247a5be5382da7464b95afbe5f0e9aa503"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check", "id": "2460650", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460650"}, "csaw": false, "cwe": "CWE-1285", "details": ["A flaw was found in the Linux kernel. A local user could potentially exploit an out-of-bounds read vulnerability in the `io_uring/fdinfo` component, specifically within the `__io_uring_show_fdinfo()` function. This issue arises from an incorrect wrap check when processing 128-byte Submission Queue Entries (SQEs) on an `IORING_SETUP_SQE_MIXED` ring, which can cause the array index to exceed its allocated boundary. Successful exploitation of this flaw could lead to information disclosure or system instability."], "name": "CVE-2026-31484", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31484\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31484\nhttps://lore.kernel.org/linux-cve-announce/2026042259-CVE-2026-31484-3268@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1cba30bf9fdd6c982708f3587f609a30c370d889,ba21ab247a5be5382da7464b95afbe5f0e9aa503)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1cba30bf9fdd6c982708f3587f609a30c370d889,5170efd9c344c68a8075dcb8ed38d3f8a60e7ed4)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T15:36:17.867821+00:00", "value": {"mitigation_remediation": ["Apply the kernel update that contains the io_uring OOB read fix.", "Reboot the system so the upgraded kernel becomes active.", "If an update is not yet available, temporarily disable the io_uring API or restrict its use until the patch is applied."], "summary": {"action": "Patch Kernel", "impact": "Local Information Disclosure"}, "threat_synthesis": {"affected_systems": "The issue is present in all Linux kernels that contain the vulnerable io_uring implementation before the commit that introduced the fix. Distributions shipping kernel releases that have not yet applied this patch are affected. No specific version numbers were provided, so all kernel builds prior to the commit are considered potentially vulnerable.", "description_and_impact": "This Linux kernel flaw in the io_uring subsystem enables an out\u2011of\u2011bounds read during the __io_uring_show_fdinfo routine, which appears when the kernel tries to display file descriptor information for a mixed\u2011size SQE ring. The wrong wrap\u2011around check uses an incremented counter instead of the actual array index, allowing the routine to read past the end of the sq_sqes array and potentially expose kernel memory content to an attacker with local user rights. The exposed data may contain sensitive information such as credentials or configuration details, but the vulnerability does not permit arbitrary code execution.", "risk_and_exploitability": "The flaw requires a local process that can invoke the __io_uring_show_fdinfo routine, implying that only privileged or local users can exploit it. The CVSS score of 7.1 indicates a significant threat, while the EPSS score of less than 1% indicates that malicious exploitation is currently unlikely. Because the vulnerability is not listed in CISA KEV, there are no confirmed exploit cases yet. Nonetheless, the data leakage could be valuable for a local adversary seeking to pivot to higher privileges or gain additional system context."}}}}, "created": "2026-04-22T20:00:08.407571+00:00", "updated": "2026-04-28T15:45:06.374368+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}