CVE-2026-31525

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31525", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.111Z", "datePublished": "2026-04-22T13:54:39.144Z", "dateUpdated": "2026-10-19T18:45:54.927Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:23:15.645Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN\n\nThe BPF interpreter's signed 32-bit division and modulo handlers use\nthe kernel abs() macro on s32 operands. The abs() macro documentation\n(include/linux/math.h) explicitly states the result is undefined when\nthe input is the type minimum. When DST contains S32_MIN (0x80000000),\nabs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged\non arm64/x86. This value is then sign-extended to u64 as\n0xFFFFFFFF80000000, causing do_div() to compute the wrong result.\n\nThe verifier's abstract interpretation (scalar32_min_max_sdiv) computes\nthe mathematically correct result for range tracking, creating a\nverifier/interpreter mismatch that can be exploited for out-of-bounds\nmap value access.\n\nIntroduce abs_s32() which handles S32_MIN correctly by casting to u32\nbefore negating, avoiding signed overflow entirely. Replace all 8\nabs((s32)...) call sites in the interpreter's sdiv32/smod32 handlers.\n\ns32 is the only affected case -- the s64 division/modulo handlers do\nnot use abs()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable interpreter code is reached by locally loading and executing a crafted eBPF program through the bpf() syscall, or by attaching/running that program through local BPF interfaces. It is not reachable directly from unauthenticated network packets without first installing attacker-controlled BPF locally.\nAC:L - There is no race or probabilistic prerequisite; the attacker controls the BPF arithmetic operands and can deterministically create the verifier/interpreter mismatch. The interpreter/JIT setting is an affected-deployment precondition, not exploit complexity once present.\nPR:L - A basic local user can reach BPF program and unprivileged map creation on systems with unprivileged BPF enabled for permitted program types such as socket filters. If disabled, higher privileges or delegation are needed, but the highest reasonable affected deployment supports PR:L.\nUI:N - The attacker can load and run or attach the malicious BPF program directly. No victim action is required.\nS:U - The impact is compromise of kernel memory and privileges within the same operating-system security authority. This is standard local kernel privilege escalation rather than a VM or hardware boundary escape.\nC:H - The verifier/interpreter mismatch can be exploited for out-of-bounds BPF map value access. Such map OOB access can disclose kernel memory and be shaped into stronger read primitives.\nI:H - Out-of-bounds map value writes allow kernel memory corruption. In BPF verifier-style bugs, this is defensibly exploitable for arbitrary write, privilege escalation, or control-flow compromise.\nA:H - The same out-of-bounds kernel memory access can corrupt critical state and crash or panic the kernel. The malicious program can be executed repeatedly by the local attacker."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/core.c"], "versions": [{"version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80", "lessThan": "694ea55f1b1c74f9942d91ec366ae9e822422e42", "status": "affected", "versionType": "git"}, {"version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80", "lessThan": "9ab1227765c446942f290c83382f0b19887c55cf", "status": "affected", "versionType": "git"}, {"version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80", "lessThan": "f14ca604c0ff274fba19f73f1f0485c0047c1396", "status": "affected", "versionType": "git"}, {"version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80", "lessThan": "0d5d8c3ce45c734aaf3c51cbef59155a6746157d", "status": "affected", "versionType": "git"}, {"version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80", "lessThan": "c77b30bd1dcb61f66c640ff7d2757816210c7cb0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/core.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.131", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.131"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/694ea55f1b1c74f9942d91ec366ae9e822422e42"}, {"url": "https://git.kernel.org/stable/c/9ab1227765c446942f290c83382f0b19887c55cf"}, {"url": "https://git.kernel.org/stable/c/f14ca604c0ff274fba19f73f1f0485c0047c1396"}, {"url": "https://git.kernel.org/stable/c/0d5d8c3ce45c734aaf3c51cbef59155a6746157d"}, {"url": "https://git.kernel.org/stable/c/c77b30bd1dcb61f66c640ff7d2757816210c7cb0"}], "title": "bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31525", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:10:36.308610Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:45:54.927Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31525", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:10:36.308610Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:10:36.876Z"}}], "cna": {"title": "bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable interpreter code is reached by locally loading and executing a crafted eBPF program through the bpf() syscall, or by attaching/running that program through local BPF interfaces. It is not reachable directly from unauthenticated network packets without first installing attacker-controlled BPF locally.\nAC:L - There is no race or probabilistic prerequisite; the attacker controls the BPF arithmetic operands and can deterministically create the verifier/interpreter mismatch. The interpreter/JIT setting is an affected-deployment precondition, not exploit complexity once present.\nPR:L - A basic local user can reach BPF program and unprivileged map creation on systems with unprivileged BPF enabled for permitted program types such as socket filters. If disabled, higher privileges or delegation are needed, but the highest reasonable affected deployment supports PR:L.\nUI:N - The attacker can load and run or attach the malicious BPF program directly. No victim action is required.\nS:U - The impact is compromise of kernel memory and privileges within the same operating-system security authority. This is standard local kernel privilege escalation rather than a VM or hardware boundary escape.\nC:H - The verifier/interpreter mismatch can be exploited for out-of-bounds BPF map value access. Such map OOB access can disclose kernel memory and be shaped into stronger read primitives.\nI:H - Out-of-bounds map value writes allow kernel memory corruption. In BPF verifier-style bugs, this is defensibly exploitable for arbitrary write, privilege escalation, or control-flow compromise.\nA:H - The same out-of-bounds kernel memory access can corrupt critical state and crash or panic the kernel. The malicious program can be executed repeatedly by the local attacker."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80", "lessThan": "694ea55f1b1c74f9942d91ec366ae9e822422e42", "versionType": "git"}, {"status": "affected", "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80", "lessThan": "9ab1227765c446942f290c83382f0b19887c55cf", "versionType": "git"}, {"status": "affected", "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80", "lessThan": "f14ca604c0ff274fba19f73f1f0485c0047c1396", "versionType": "git"}, {"status": "affected", "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80", "lessThan": "0d5d8c3ce45c734aaf3c51cbef59155a6746157d", "versionType": "git"}, {"status": "affected", "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80", "lessThan": "c77b30bd1dcb61f66c640ff7d2757816210c7cb0", "versionType": "git"}], "programFiles": ["kernel/bpf/core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"status": "unaffected", "version": "0", "lessThan": "6.6", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.131", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.80", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.21", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/bpf/core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/694ea55f1b1c74f9942d91ec366ae9e822422e42"}, {"url": "https://git.kernel.org/stable/c/9ab1227765c446942f290c83382f0b19887c55cf"}, {"url": "https://git.kernel.org/stable/c/f14ca604c0ff274fba19f73f1f0485c0047c1396"}, {"url": "https://git.kernel.org/stable/c/0d5d8c3ce45c734aaf3c51cbef59155a6746157d"}, {"url": "https://git.kernel.org/stable/c/c77b30bd1dcb61f66c640ff7d2757816210c7cb0"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN\n\nThe BPF interpreter's signed 32-bit division and modulo handlers use\nthe kernel abs() macro on s32 operands. The abs() macro documentation\n(include/linux/math.h) explicitly states the result is undefined when\nthe input is the type minimum. When DST contains S32_MIN (0x80000000),\nabs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged\non arm64/x86. This value is then sign-extended to u64 as\n0xFFFFFFFF80000000, causing do_div() to compute the wrong result.\n\nThe verifier's abstract interpretation (scalar32_min_max_sdiv) computes\nthe mathematically correct result for range tracking, creating a\nverifier/interpreter mismatch that can be exploited for out-of-bounds\nmap value access.\n\nIntroduce abs_s32() which handles S32_MIN correctly by casting to u32\nbefore negating, avoiding signed overflow entirely. Replace all 8\nabs((s32)...) call sites in the interpreter's sdiv32/smod32 handlers.\n\ns32 is the only affected case -- the s64 division/modulo handlers do\nnot use abs()."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.131", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:23:15.645Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31525", "state": "PUBLISHED", "dateUpdated": "2026-10-19T18:45:54.927Z", "dateReserved": "2026-03-09T15:48:24.111Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-22T13:54:39.144Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "694ea55f1b1c74f9942d91ec366ae9e822422e42", "status": "affected", "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80", "versionType": "git"}, {"lessThan": "9ab1227765c446942f290c83382f0b19887c55cf", "status": "affected", "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80", "versionType": "git"}, {"lessThan": "f14ca604c0ff274fba19f73f1f0485c0047c1396", "status": "affected", "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80", "versionType": "git"}, {"lessThan": "0d5d8c3ce45c734aaf3c51cbef59155a6746157d", "status": "affected", "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80", "versionType": "git"}, {"lessThan": "c77b30bd1dcb61f66c640ff7d2757816210c7cb0", "status": "affected", "version": "ec0e2da95f72d4a46050a4d994e4fe471474fd80", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.131", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.80", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2DC0D2CD-6CF8-469A-B3F5-E48375FDA274", "versionEndExcluding": "6.6.131", "versionStartIncluding": "6.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED39847A-3B46-4729-B7CA-B2C30B9FA8FE", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN\n\nThe BPF interpreter's signed 32-bit division and modulo handlers use\nthe kernel abs() macro on s32 operands. The abs() macro documentation\n(include/linux/math.h) explicitly states the result is undefined when\nthe input is the type minimum. When DST contains S32_MIN (0x80000000),\nabs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged\non arm64/x86. This value is then sign-extended to u64 as\n0xFFFFFFFF80000000, causing do_div() to compute the wrong result.\n\nThe verifier's abstract interpretation (scalar32_min_max_sdiv) computes\nthe mathematically correct result for range tracking, creating a\nverifier/interpreter mismatch that can be exploited for out-of-bounds\nmap value access.\n\nIntroduce abs_s32() which handles S32_MIN correctly by casting to u32\nbefore negating, avoiding signed overflow entirely. Replace all 8\nabs((s32)...) call sites in the interpreter's sdiv32/smod32 handlers.\n\ns32 is the only affected case -- the s64 division/modulo handlers do\nnot use abs()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbpf: Corrige el comportamiento indefinido en el int\u00e9rprete sdiv/smod para INT_MIN\n\nLos manejadores de divisi\u00f3n y m\u00f3dulo con signo de 32 bits del int\u00e9rprete BPF usan la macro abs() del kernel en operandos s32. La documentaci\u00f3n de la macro abs() (include/linux/math.h) establece expl\u00edcitamente que el resultado es indefinido cuando la entrada es el m\u00ednimo del tipo. Cuando DST contiene S32_MIN (0x 80000000), abs((s32)DST) desencadena un comportamiento indefinido y devuelve S32_MIN sin cambios en arm64/x86. Este valor es luego extendido por signo a u64 como 0x FFFFFFFF80000000, haciendo que do_div() calcule el resultado incorrecto.\n\nLa interpretaci\u00f3n abstracta del verificador (scalar32_min_max_sdiv) calcula el resultado matem\u00e1ticamente correcto para el seguimiento de rangos, creando una discrepancia entre verificador/int\u00e9rprete que puede ser explotada para acceso a valores de mapa fuera de l\u00edmites.\n\nSe introduce abs_s32() que maneja S32_MIN correctamente al convertir a u32 antes de negar, evitando completamente el desbordamiento con signo. Reemplazar los 8 sitios de llamada de abs((s32)...) en los manejadores sdiv32/smod32 del int\u00e9rprete.\n\ns32 es el \u00fanico caso afectado - - los manejadores de divisi\u00f3n/m\u00f3dulo s64 no usan abs()."}], "id": "CVE-2026-31525", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31525", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:10:36.308610Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:52.607", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0d5d8c3ce45c734aaf3c51cbef59155a6746157d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/694ea55f1b1c74f9942d91ec366ae9e822422e42"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9ab1227765c446942f290c83382f0b19887c55cf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c77b30bd1dcb61f66c640ff7d2757816210c7cb0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f14ca604c0ff274fba19f73f1f0485c0047c1396"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-190"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN", "id": "2460672", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460672"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) interpreter. The interpreter's signed 32-bit division and modulo operations exhibit undefined behavior when processing the minimum 32-bit signed integer value (S32_MIN) due to an incorrect use of the `abs()` macro. This inconsistency between the interpreter's execution and the verifier's expected behavior can be leveraged by a local attacker. Successful exploitation could lead to out-of-bounds memory access within BPF maps, potentially resulting in information disclosure or privilege escalation."], "name": "CVE-2026-31525", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31525\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31525\nhttps://lore.kernel.org/linux-cve-announce/2026042213-CVE-2026-31525-0fff@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec0e2da95f72d4a46050a4d994e4fe471474fd80,694ea55f1b1c74f9942d91ec366ae9e822422e42)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec0e2da95f72d4a46050a4d994e4fe471474fd80,9ab1227765c446942f290c83382f0b19887c55cf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec0e2da95f72d4a46050a4d994e4fe471474fd80,f14ca604c0ff274fba19f73f1f0485c0047c1396)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec0e2da95f72d4a46050a4d994e4fe471474fd80,0d5d8c3ce45c734aaf3c51cbef59155a6746157d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec0e2da95f72d4a46050a4d994e4fe471474fd80,c77b30bd1dcb61f66c640ff7d2757816210c7cb0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.131,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.80,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-29T01:44:47.411756+00:00", "value": {"mitigation_remediation": ["Upgrade the Linux kernel to a version that contains the abs_s32 patch and the updated sdiv/smod handlers.", "If an immediate kernel update is not possible, restrict BPF program loading to trusted users or disable unnecessary BPF functionality via kernel configuration or sysctl settings.", "Monitor for anomalous eBPF activity and apply relevant access controls to detect suspicious behavior."], "summary": {"action": "Patch", "impact": "Out-of-Bounds Access"}, "threat_synthesis": {"affected_systems": "All Linux kernel releases prior to the introduction of the abs_s32 helper in the eBPF interpreter are affected. The code impact lies in the sdiv32 and smod32 handlers for signed 32\u2011bit operations. No specific release ranges are listed, so any kernel version lacking this patch remains vulnerable.", "description_and_impact": "The vulnerability exploits undefined behavior in the Linux kernel\u2019s eBPF interpreter when performing signed 32\u2011bit division or modulo on the INT_MIN value. The interpreter uses the abs() macro on that value, producing an undefined result that causes the division to compute an incorrect quotient. This mismatch between the interpreter and the verifier\u2019s abstract interpretation creates an out\u2011of\u2011bounds map access path, which is inferred to potentially enable data leakage or denial of service.", "risk_and_exploitability": "The CVSS base score of 7.8 indicates high severity. EPSS score indicates a very low exploitation probability (<1%) and the vulnerability is not listed in CISA\u2019s KEV catalog. The flaw permits an out\u2011of\u2011bounds memory access path in the BPF interpreter when a signed 32\u2011bit division or modulo is performed with the INT_MIN value. The exact attack vector is not explicitly documented, but based on the description it is inferred that a malicious eBPF program that exercises the affected operation could trigger the error. The ability to load such a program is typically restricted to privileged users, so the threat is limited to environments where untrusted BPF code can be introduced. Administrators should treat the potential memory corruption as a high\u2011risk issue."}}}}, "created": "2026-04-22T19:00:07.810174+00:00", "updated": "2026-04-29T01:45:26.036758+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}