CVE-2026-31690

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31690", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.131Z", "datePublished": "2026-04-27T17:34:28.738Z", "dateUpdated": "2026-05-11T22:13:45.476Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:13:45.476Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: thead: Fix buffer overflow and use standard endian macros\n\nAddresses two issues in the TH1520 AON firmware protocol driver:\n\n1. Fix a potential buffer overflow where the code used unsafe pointer\n arithmetic to access the 'mode' field through the 'resource' pointer\n with an offset. This was flagged by Smatch static checker as:\n \"buffer overflow 'data' 2 <= 3\"\n\n2. Replace custom RPC_SET_BE* and RPC_GET_BE* macros with standard\n kernel endianness conversion macros (cpu_to_be16, etc.) for better\n portability and maintainability.\n\nThe functionality was re-tested with the GPU power-up sequence,\nconfirming the GPU powers up correctly and the driver probes\nsuccessfully.\n\n[ 12.702370] powervr ffef400000.gpu: [drm] loaded firmware\npowervr/rogue_36.52.104.182_v1.fw\n[ 12.711043] powervr ffef400000.gpu: [drm] FW version v1.0 (build\n6645434 OS)\n[ 12.719787] [drm] Initialized powervr 1.0.0 for ffef400000.gpu on\nminor 0"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/thead,th1520-aon.c", "include/linux/firmware/thead/thead,th1520-aon.h"], "versions": [{"version": "e4b3cbd840e565484d0ad8d260d27c057466ed17", "lessThan": "fbdb43f6bb2a15ed382d6eb0ef82c8b07b0d47bb", "status": "affected", "versionType": "git"}, {"version": "e4b3cbd840e565484d0ad8d260d27c057466ed17", "lessThan": "bd15a5deb5a7251dc1a0cf9186f0253f7eacdb97", "status": "affected", "versionType": "git"}, {"version": "e4b3cbd840e565484d0ad8d260d27c057466ed17", "lessThan": "88c4bd90725557796c15878b7cb70066e9e6b5ab", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/thead,th1520-aon.c", "include/linux/firmware/thead/thead,th1520-aon.h"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.23", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.13", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.19.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fbdb43f6bb2a15ed382d6eb0ef82c8b07b0d47bb"}, {"url": "https://git.kernel.org/stable/c/bd15a5deb5a7251dc1a0cf9186f0253f7eacdb97"}, {"url": "https://git.kernel.org/stable/c/88c4bd90725557796c15878b7cb70066e9e6b5ab"}], "title": "firmware: thead: Fix buffer overflow and use standard endian macros", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/firmware/thead,th1520-aon.c", "include/linux/firmware/thead/thead,th1520-aon.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fbdb43f6bb2a15ed382d6eb0ef82c8b07b0d47bb", "status": "affected", "version": "e4b3cbd840e565484d0ad8d260d27c057466ed17", "versionType": "git"}, {"lessThan": "bd15a5deb5a7251dc1a0cf9186f0253f7eacdb97", "status": "affected", "version": "e4b3cbd840e565484d0ad8d260d27c057466ed17", "versionType": "git"}, {"lessThan": "88c4bd90725557796c15878b7cb70066e9e6b5ab", "status": "affected", "version": "e4b3cbd840e565484d0ad8d260d27c057466ed17", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/firmware/thead,th1520-aon.c", "include/linux/firmware/thead/thead,th1520-aon.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.23", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "087D96F9-5A25-4AC4-AA79-B18E87DE65DF", "versionEndExcluding": "6.18.23", "versionStartIncluding": "6.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1490EF9B-9080-481C-8D22-1306AAE664E4", "versionEndExcluding": "6.19.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: thead: Fix buffer overflow and use standard endian macros\n\nAddresses two issues in the TH1520 AON firmware protocol driver:\n\n1. Fix a potential buffer overflow where the code used unsafe pointer\n arithmetic to access the 'mode' field through the 'resource' pointer\n with an offset. This was flagged by Smatch static checker as:\n \"buffer overflow 'data' 2 <= 3\"\n\n2. Replace custom RPC_SET_BE* and RPC_GET_BE* macros with standard\n kernel endianness conversion macros (cpu_to_be16, etc.) for better\n portability and maintainability.\n\nThe functionality was re-tested with the GPU power-up sequence,\nconfirming the GPU powers up correctly and the driver probes\nsuccessfully.\n\n[ 12.702370] powervr ffef400000.gpu: [drm] loaded firmware\npowervr/rogue_36.52.104.182_v1.fw\n[ 12.711043] powervr ffef400000.gpu: [drm] FW version v1.0 (build\n6645434 OS)\n[ 12.719787] [drm] Initialized powervr 1.0.0 for ffef400000.gpu on\nminor 0"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nfirmware: thead: Corrige el desbordamiento de b\u00fafer y usa macros endian est\u00e1ndar\n\nAborda dos problemas en el controlador del protocolo de firmware AON TH1520:\n\n1. Corrige un posible desbordamiento de b\u00fafer donde el c\u00f3digo usaba aritm\u00e9tica de punteros insegura para acceder al campo \u2019mode\u2019 a trav\u00e9s del puntero \u2019resource\u2019 con un desplazamiento. Esto fue marcado por el verificador est\u00e1tico Smatch como: \u2019buffer overflow \u2019data\u2019 2 menor o igual que 3\u2019\n\n2. Reemplaza las macros personalizadas RPC_SET_BE y RPC_GET_BE con macros est\u00e1ndar de conversi\u00f3n de endianness del kernel (cpu_to_be16, etc.) para una mejor portabilidad y mantenibilidad.\n\nLa funcionalidad fue reevaluada con la secuencia de encendido de la GPU, confirmando que la GPU se enciende correctamente y el controlador se inicializa con \u00e9xito.\n\n[ 12.702370] powervr ffef400000.gpu: [drm] firmware cargado powervr/rogue_36.52.104.182_v1.fw\n[ 12.711043] powervr ffef400000.gpu: [drm] Versi\u00f3n de FW v1.0 (compilaci\u00f3n 6645434 OS)\n[ 12.719787] [drm] powervr 1.0.0 inicializado para ffef400000.gpu en minor 0"}], "id": "CVE-2026-31690", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-27T18:16:54.507", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/88c4bd90725557796c15878b7cb70066e9e6b5ab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bd15a5deb5a7251dc1a0cf9186f0253f7eacdb97"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fbdb43f6bb2a15ed382d6eb0ef82c8b07b0d47bb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: firmware: thead: Fix buffer overflow and use standard endian macros", "id": "2463258", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463258"}, "csaw": false, "cwe": "CWE-823", "details": ["A flaw was found in the Linux kernel's TH1520 AON firmware protocol driver. This buffer overflow vulnerability arises from unsafe pointer arithmetic used to access the 'mode' field through the 'resource' pointer with an offset. This could potentially lead to memory corruption within the kernel."], "name": "CVE-2026-31690", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31690\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31690\nhttps://lore.kernel.org/linux-cve-announce/2026042757-CVE-2026-31690-018e@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e4b3cbd840e565484d0ad8d260d27c057466ed17,fbdb43f6bb2a15ed382d6eb0ef82c8b07b0d47bb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e4b3cbd840e565484d0ad8d260d27c057466ed17,bd15a5deb5a7251dc1a0cf9186f0253f7eacdb97)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e4b3cbd840e565484d0ad8d260d27c057466ed17,88c4bd90725557796c15878b7cb70066e9e6b5ab)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.23,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.13,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-04-28T02:30:18.594176+00:00", "updated": "2026-05-06T19:45:10.666369+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}