CVE-2026-31505

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31505", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.105Z", "datePublished": "2026-04-22T13:54:24.524Z", "dateUpdated": "2026-10-30T12:24:18.267Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:24:18.267Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\n\niavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the\nvalue could change in runtime, we should use num_tx_queues instead.\n\nMoreover iavf_get_ethtool_stats() uses num_active_queues while\niavf_get_sset_count() and iavf_get_stat_strings() use\nreal_num_tx_queues, which triggers out-of-bounds writes when we do\n\"ethtool -L\" and \"ethtool -S\" simultaneously [1].\n\nFor example when we change channels from 1 to 8, Thread 3 could be\nscheduled before Thread 2, and out-of-bounds writes could be triggered\nin Thread 3:\n\nThread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S)\niavf_set_channels()\n...\niavf_alloc_queues()\n-> num_active_queues = 8\niavf_schedule_finish_config()\n iavf_get_sset_count()\n real_num_tx_queues: 1\n -> buffer for 1 queue\n iavf_get_ethtool_stats()\n num_active_queues: 8\n -> out-of-bounds!\n iavf_finish_config()\n -> real_num_tx_queues = 8\n\nUse immutable num_tx_queues in all related functions to avoid the issue.\n\n[1]\n BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270\n Write of size 8 at addr ffffc900031c9080 by task ethtool/5800\n\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n <TASK>\n dump_stack_lvl+0x6f/0xb0\n print_report+0x170/0x4f3\n kasan_report+0xe1/0x180\n iavf_add_one_ethtool_stat+0x200/0x270\n iavf_get_ethtool_stats+0x14c/0x2e0\n __dev_ethtool+0x3d0c/0x5830\n dev_ethtool+0x12d/0x270\n dev_ioctl+0x53c/0xe30\n sock_do_ioctl+0x1a9/0x270\n sock_ioctl+0x3d4/0x5e0\n __x64_sys_ioctl+0x137/0x1c0\n do_syscall_64+0xf3/0x690\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f7da0e6e36d\n ...\n </TASK>\n\n The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830\n The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff88813a013de0 pfn:0x13a013\n flags: 0x200000000000000(node=0|zone=2)\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n >ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached locally through `ioctl(SIOCETHTOOL)` on a socket, specifically `ETHTOOL_GSTATS` calling the iavf ethtool statistics callback. Remote packets may influence counter values but do not directly invoke the vulnerable code.\nAC:L - The bug is a race between attacker-issued channel reconfiguration and stats retrieval; the attacker can repeatedly run `ethtool -L` and `ethtool -S` to hit the window before `finish_config` updates `real_num_tx_queues`. No rare external condition is required.\nPR:L - `ETHTOOL_GSTATS` is allowed to any local user, but reliably creating the mismatched queue-count state requires `ETHTOOL_SCHANNELS`, gated by `ns_capable(net->user_ns, CAP_NET_ADMIN)`. In plausible delegated VF/container netns deployments this is a low namespace privilege rather than real init-namespace root.\nUI:N - No victim action is required when the attacker has the needed local namespace capability; the attacker can issue both ethtool operations directly. The vulnerable stats read itself is synchronous from the attacker\u2019s ioctl.\nS:U - The corruption occurs inside the same kernel security authority as the vulnerable network driver. This is standard kernel memory corruption/privilege escalation, not a VM escape or IOMMU boundary bypass.\nC:H - The flaw is an out-of-bounds kernel write in a vmalloc-backed stats buffer, which is memory corruption that can plausibly be leveraged during exploitation for information disclosure. Under the required conservative rule, this is High.\nI:H - The vulnerable function writes attacker-influenced u64 statistics past the allocated buffer when queue counts diverge. Out-of-bounds kernel writes are treated as high integrity impact because they can corrupt kernel memory and potentially enable code execution.\nA:H - The reported failure is a KASAN vmalloc-out-of-bounds write in kernel context, and the same corruption can oops or panic the kernel. The trigger can be repeated by local ethtool calls."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/iavf/iavf_ethtool.c"], "versions": [{"version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "lessThan": "20a31b84b3e3af21bbb2628fdad185b1f274a5f5", "status": "affected", "versionType": "git"}, {"version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "lessThan": "d5dcca707f56c46582486d783c1eca2323189111", "status": "affected", "versionType": "git"}, {"version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "lessThan": "1f931dee5b726df1940348ec31614d64bac03aa6", "status": "affected", "versionType": "git"}, {"version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "lessThan": "bb85741d2dc2be207353a412f51b83697fcbefcf", "status": "affected", "versionType": "git"}, {"version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "lessThan": "fdf902bf86a80bf15792a1d20a67a5302498d7f1", "status": "affected", "versionType": "git"}, {"version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "lessThan": "fecacfc95f195b99c71c579a472120d0b4ed65fa", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/iavf/iavf_ethtool.c"], "versions": [{"version": "5.17", "status": "affected"}, {"version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/20a31b84b3e3af21bbb2628fdad185b1f274a5f5"}, {"url": "https://git.kernel.org/stable/c/d5dcca707f56c46582486d783c1eca2323189111"}, {"url": "https://git.kernel.org/stable/c/1f931dee5b726df1940348ec31614d64bac03aa6"}, {"url": "https://git.kernel.org/stable/c/bb85741d2dc2be207353a412f51b83697fcbefcf"}, {"url": "https://git.kernel.org/stable/c/fdf902bf86a80bf15792a1d20a67a5302498d7f1"}, {"url": "https://git.kernel.org/stable/c/fecacfc95f195b99c71c579a472120d0b4ed65fa"}], "title": "iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31505", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:10:20.590718Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:45:54.087Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31505", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:10:20.590718Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:10:21.189Z"}}], "cna": {"title": "iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached locally through `ioctl(SIOCETHTOOL)` on a socket, specifically `ETHTOOL_GSTATS` calling the iavf ethtool statistics callback. Remote packets may influence counter values but do not directly invoke the vulnerable code.\nAC:L - The bug is a race between attacker-issued channel reconfiguration and stats retrieval; the attacker can repeatedly run `ethtool -L` and `ethtool -S` to hit the window before `finish_config` updates `real_num_tx_queues`. No rare external condition is required.\nPR:L - `ETHTOOL_GSTATS` is allowed to any local user, but reliably creating the mismatched queue-count state requires `ETHTOOL_SCHANNELS`, gated by `ns_capable(net->user_ns, CAP_NET_ADMIN)`. In plausible delegated VF/container netns deployments this is a low namespace privilege rather than real init-namespace root.\nUI:N - No victim action is required when the attacker has the needed local namespace capability; the attacker can issue both ethtool operations directly. The vulnerable stats read itself is synchronous from the attacker\u2019s ioctl.\nS:U - The corruption occurs inside the same kernel security authority as the vulnerable network driver. This is standard kernel memory corruption/privilege escalation, not a VM escape or IOMMU boundary bypass.\nC:H - The flaw is an out-of-bounds kernel write in a vmalloc-backed stats buffer, which is memory corruption that can plausibly be leveraged during exploitation for information disclosure. Under the required conservative rule, this is High.\nI:H - The vulnerable function writes attacker-influenced u64 statistics past the allocated buffer when queue counts diverge. Out-of-bounds kernel writes are treated as high integrity impact because they can corrupt kernel memory and potentially enable code execution.\nA:H - The reported failure is a KASAN vmalloc-out-of-bounds write in kernel context, and the same corruption can oops or panic the kernel. The trigger can be repeated by local ethtool calls."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "lessThan": "20a31b84b3e3af21bbb2628fdad185b1f274a5f5", "versionType": "git"}, {"status": "affected", "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "lessThan": "d5dcca707f56c46582486d783c1eca2323189111", "versionType": "git"}, {"status": "affected", "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "lessThan": "1f931dee5b726df1940348ec31614d64bac03aa6", "versionType": "git"}, {"status": "affected", "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "lessThan": "bb85741d2dc2be207353a412f51b83697fcbefcf", "versionType": "git"}, {"status": "affected", "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "lessThan": "fdf902bf86a80bf15792a1d20a67a5302498d7f1", "versionType": "git"}, {"status": "affected", "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "lessThan": "fecacfc95f195b99c71c579a472120d0b4ed65fa", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/intel/iavf/iavf_ethtool.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"status": "unaffected", "version": "0", "lessThan": "5.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.80", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.21", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/intel/iavf/iavf_ethtool.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/20a31b84b3e3af21bbb2628fdad185b1f274a5f5"}, {"url": "https://git.kernel.org/stable/c/d5dcca707f56c46582486d783c1eca2323189111"}, {"url": "https://git.kernel.org/stable/c/1f931dee5b726df1940348ec31614d64bac03aa6"}, {"url": "https://git.kernel.org/stable/c/bb85741d2dc2be207353a412f51b83697fcbefcf"}, {"url": "https://git.kernel.org/stable/c/fdf902bf86a80bf15792a1d20a67a5302498d7f1"}, {"url": "https://git.kernel.org/stable/c/fecacfc95f195b99c71c579a472120d0b4ed65fa"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\n\niavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the\nvalue could change in runtime, we should use num_tx_queues instead.\n\nMoreover iavf_get_ethtool_stats() uses num_active_queues while\niavf_get_sset_count() and iavf_get_stat_strings() use\nreal_num_tx_queues, which triggers out-of-bounds writes when we do\n\"ethtool -L\" and \"ethtool -S\" simultaneously [1].\n\nFor example when we change channels from 1 to 8, Thread 3 could be\nscheduled before Thread 2, and out-of-bounds writes could be triggered\nin Thread 3:\n\nThread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S)\niavf_set_channels()\n...\niavf_alloc_queues()\n-> num_active_queues = 8\niavf_schedule_finish_config()\n iavf_get_sset_count()\n real_num_tx_queues: 1\n -> buffer for 1 queue\n iavf_get_ethtool_stats()\n num_active_queues: 8\n -> out-of-bounds!\n iavf_finish_config()\n -> real_num_tx_queues = 8\n\nUse immutable num_tx_queues in all related functions to avoid the issue.\n\n[1]\n BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270\n Write of size 8 at addr ffffc900031c9080 by task ethtool/5800\n\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n <TASK>\n dump_stack_lvl+0x6f/0xb0\n print_report+0x170/0x4f3\n kasan_report+0xe1/0x180\n iavf_add_one_ethtool_stat+0x200/0x270\n iavf_get_ethtool_stats+0x14c/0x2e0\n __dev_ethtool+0x3d0c/0x5830\n dev_ethtool+0x12d/0x270\n dev_ioctl+0x53c/0xe30\n sock_do_ioctl+0x1a9/0x270\n sock_ioctl+0x3d4/0x5e0\n __x64_sys_ioctl+0x137/0x1c0\n do_syscall_64+0xf3/0x690\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f7da0e6e36d\n ...\n </TASK>\n\n The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830\n The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff88813a013de0 pfn:0x13a013\n flags: 0x200000000000000(node=0|zone=2)\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n >ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "5.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "5.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.80", "versionStartIncluding": "5.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.21", "versionStartIncluding": "5.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.11", "versionStartIncluding": "5.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "5.17"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:24:18.267Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31505", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:24:18.267Z", "dateReserved": "2026-03-09T15:48:24.105Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-22T13:54:24.524Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/iavf/iavf_ethtool.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "20a31b84b3e3af21bbb2628fdad185b1f274a5f5", "status": "affected", "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "versionType": "git"}, {"lessThan": "d5dcca707f56c46582486d783c1eca2323189111", "status": "affected", "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "versionType": "git"}, {"lessThan": "1f931dee5b726df1940348ec31614d64bac03aa6", "status": "affected", "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "versionType": "git"}, {"lessThan": "bb85741d2dc2be207353a412f51b83697fcbefcf", "status": "affected", "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "versionType": "git"}, {"lessThan": "fdf902bf86a80bf15792a1d20a67a5302498d7f1", "status": "affected", "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "versionType": "git"}, {"lessThan": "fecacfc95f195b99c71c579a472120d0b4ed65fa", "status": "affected", "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/iavf/iavf_ethtool.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"lessThan": "5.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.80", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "803A2BAF-5A16-46AC-B6F6-5128B48C13FF", "versionEndExcluding": "6.12.80", "versionStartIncluding": "5.17.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED39847A-3B46-4729-B7CA-B2C30B9FA8FE", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*", "matchCriteriaId": "A59F7FD3-F505-48BD-8875-F07A33F42F6C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\n\niavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the\nvalue could change in runtime, we should use num_tx_queues instead.\n\nMoreover iavf_get_ethtool_stats() uses num_active_queues while\niavf_get_sset_count() and iavf_get_stat_strings() use\nreal_num_tx_queues, which triggers out-of-bounds writes when we do\n\"ethtool -L\" and \"ethtool -S\" simultaneously [1].\n\nFor example when we change channels from 1 to 8, Thread 3 could be\nscheduled before Thread 2, and out-of-bounds writes could be triggered\nin Thread 3:\n\nThread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S)\niavf_set_channels()\n...\niavf_alloc_queues()\n-> num_active_queues = 8\niavf_schedule_finish_config()\n iavf_get_sset_count()\n real_num_tx_queues: 1\n -> buffer for 1 queue\n iavf_get_ethtool_stats()\n num_active_queues: 8\n -> out-of-bounds!\n iavf_finish_config()\n -> real_num_tx_queues = 8\n\nUse immutable num_tx_queues in all related functions to avoid the issue.\n\n[1]\n BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270\n Write of size 8 at addr ffffc900031c9080 by task ethtool/5800\n\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n <TASK>\n dump_stack_lvl+0x6f/0xb0\n print_report+0x170/0x4f3\n kasan_report+0xe1/0x180\n iavf_add_one_ethtool_stat+0x200/0x270\n iavf_get_ethtool_stats+0x14c/0x2e0\n __dev_ethtool+0x3d0c/0x5830\n dev_ethtool+0x12d/0x270\n dev_ioctl+0x53c/0xe30\n sock_do_ioctl+0x1a9/0x270\n sock_ioctl+0x3d4/0x5e0\n __x64_sys_ioctl+0x137/0x1c0\n do_syscall_64+0xf3/0x690\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f7da0e6e36d\n ...\n </TASK>\n\n The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830\n The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff88813a013de0 pfn:0x13a013\n flags: 0x200000000000000(node=0|zone=2)\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n >ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niavf: correcci\u00f3n de escrituras fuera de l\u00edmites en iavf_get_ethtool_stats()\n\niavf utiliza incorrectamente real_num_tx_queues para ETH_SS_STATS. Dado que el valor podr\u00eda cambiar en tiempo de ejecuci\u00f3n, deber\u00edamos usar num_tx_queues en su lugar.\n\nAdem\u00e1s, iavf_get_ethtool_stats() utiliza num_active_queues mientras que iavf_get_sset_count() y iavf_get_stat_strings() utilizan real_num_tx_queues, lo que desencadena escrituras fuera de l\u00edmites cuando ejecutamos \u2019ethtool -L\u2019 y \u2019ethtool -S\u2019 simult\u00e1neamente [1].\n\nPor ejemplo, cuando cambiamos los canales de 1 a 8, el Hilo 3 podr\u00eda ser programado antes que el Hilo 2, y se podr\u00edan desencadenar escrituras fuera de l\u00edmites en el Hilo 3:\n\nHilo 1 (ethtool -L) Hilo 2 (trabajo) Hilo 3 (ethtool -S)\niavf_set_channels()\n...\niavf_alloc_queues()\n -> num_active_queues = 8\niavf_schedule_finish_config()\n iavf_get_sset_count()\n real_num_tx_queues: 1\n -> b\u00fafer para 1 cola\n iavf_get_ethtool_stats()\n num_active_queues: 8\n -> \u00a1fuera de l\u00edmites!\n iavf_finish_config()\n -> real_num_tx_queues = 8\n\nUsar num_tx_queues inmutable en todas las funciones relacionadas para evitar el problema.\n\n[1]\n BUG: KASAN: vmalloc-out-of-bounds en iavf_add_one_ethtool_stat+0x200/0x270\n Escritura de tama\u00f1o 8 en la direcci\u00f3n ffffc900031c9080 por la tarea ethtool/5800\n\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Traza de Llamadas:\n [TAREA]\n dump_stack_lvl+0x6f/0xb0\n print_report+0x170/0x4f3\n kasan_report+0xe1/0x180\n iavf_add_one_ethtool_stat+0x200/0x270\n iavf_get_ethtool_stats+0x14c/0x2e0\n __dev_ethtool+0x 3d0c/0x 5830\n dev_ethtool+0x12d/0x270\n dev_ioctl+0x53c/0xe30\n sock_do_ioctl+0x1a9/0x270\n sock_ioctl+0x3d4/0x5e0\n __x64_sys_ioctl+0x137/0x1c0\n do_syscall_64+0xf3/0x690\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x 7f7da0e6e36d\n ...\n [/TAREA]\n\n La direcci\u00f3n err\u00f3nea pertenece a una regi\u00f3n vmalloc de 1 p\u00e1gina que comienza en 0x ffffc900031c9000 asignada en __dev_ethtool+0x 3cc9/0x 5830\n La direcci\u00f3n err\u00f3nea pertenece a la p\u00e1gina f\u00edsica: page: refcount:1 mapcount:0 mapping:0000000000000000\n index:0x ffff88813a013de0 pfn:0x 13a013\n flags: 0x 200000000000000(node=0|zone=2)\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\n p\u00e1gina volcada porque: kasan: acceso incorrecto detectado\n\n Estado de la memoria alrededor de la direcci\u00f3n err\u00f3nea:\n ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n >ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8"}], "id": "CVE-2026-31505", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31505", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:10:20.590718Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:49.233", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1f931dee5b726df1940348ec31614d64bac03aa6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/20a31b84b3e3af21bbb2628fdad185b1f274a5f5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bb85741d2dc2be207353a412f51b83697fcbefcf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d5dcca707f56c46582486d783c1eca2323189111"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fdf902bf86a80bf15792a1d20a67a5302498d7f1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fecacfc95f195b99c71c579a472120d0b4ed65fa"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()", "id": "2460688", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460688"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["A flaw was found in the Linux kernel's iavf driver. This vulnerability, an out-of-bounds write, occurs when a user simultaneously executes specific ethtool commands, specifically \"ethtool -L\" and \"ethtool -S\". This can lead to memory corruption, potentially causing a system crash and resulting in a Denial of Service (DoS)."], "name": "CVE-2026-31505", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31505\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31505\nhttps://lore.kernel.org/linux-cve-announce/2026042206-CVE-2026-31505-a1db@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[64430f70ba6fcd5872ac190f4ae3ddee3f48f00d,1f931dee5b726df1940348ec31614d64bac03aa6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[64430f70ba6fcd5872ac190f4ae3ddee3f48f00d,bb85741d2dc2be207353a412f51b83697fcbefcf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[64430f70ba6fcd5872ac190f4ae3ddee3f48f00d,fdf902bf86a80bf15792a1d20a67a5302498d7f1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[64430f70ba6fcd5872ac190f4ae3ddee3f48f00d,fecacfc95f195b99c71c579a472120d0b4ed65fa)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.80,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T20:50:00.927085+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that includes commit 1f931dee5b726df1940348ec31614d64bac03aa6, which removes the out\u2011of\u2011bounds write (CWE\u2011805).", "Avoid running ethtool \u2013L and \u2013S at the same time; apply channel changes and retrieve statistics in separate sessions to eliminate the race condition.", "If a kernel upgrade cannot be performed immediately, restrict the privileges of ethtool by applying SELinux or AppArmor policies that deny CAP_SYS_ADMIN for the command and monitor dmesg or journal logs for KASAN or Oops messages indicating residual corruption."], "summary": {"action": "Patch Now", "impact": "Kernel memory corruption"}, "threat_synthesis": {"affected_systems": "The flaw exists in all Linux kernel releases that ship the unpatched iavf driver, including the 6.19.0 kernel and earlier. The patch that fixes the issue is identified by commit 1f931dee5b726df1940348ec31614d64bac03aa6 and is referenced in the advisory links. Kernels that have not yet incorporated this commit remain vulnerable.", "description_and_impact": "In the iavf driver for the Linux kernel, a race between channel reconfiguration (ethtool -L) and statistics retrieval (ethtool -S) causes the driver to use inconsistent queue counters, leading to out\u2011of\u2011bounds writes into the statistics buffer. This buffer overflow (CWE\u2011805 and CWE\u2011787) can corrupt kernel memory, trigger a crash, or, if an attacker can control the overwrite, enable local privilege escalation. The vulnerability directly impacts kernel integrity and availability, with potential secondary effects on confidentiality if memory corruption leaks sensitive data.", "risk_and_exploitability": "The CVSS score for this vulnerability is 7.8, indicating a high severity. The EPSS score is reported as less than 1\u202f%, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the ethtool command generally requires root or CAP_SYS_ADMIN privileges. Therefore, the exploit is limited to local users with elevated privileges, reducing the likelihood of widespread compromise but still presenting a significant risk for systems that allow such users to perform channel configuration and statistics queries simultaneously."}}}}, "created": "2026-04-22T18:00:05.275687+00:00", "updated": "2026-04-28T21:00:14.749591+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}