CVE-2026-31735

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31735", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.137Z", "datePublished": "2026-05-01T14:14:32.923Z", "dateUpdated": "2026-08-05T12:24:53.937Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:53.937Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommupt: Fix short gather if the unmap goes into a large mapping\n\nunmap has the odd behavior that it can unmap more than requested if the\nending point lands within the middle of a large or contiguous IOPTE.\n\nIn this case the gather should flush everything unmapped which can be\nlarger than what was requested to be unmapped. The gather was only\nflushing the range requested to be unmapped, not extending to the extra\nrange, resulting in a short invalidation if the caller hits this special\ncondition.\n\nThis was found by the new invalidation/gather test I am adding in\npreparation for ARMv8. Claude deduced the root cause.\n\nAs far as I remember nothing relies on unmapping a large entry, so this is\nlikely not a triggerable bug."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable unmap path is reached through local iommufd/VFIO ioctls after a process has a bound IOMMU-backed device/domain. There is no network, adjacent-radio, or physical-only packet path to this code.\nAC:L - The bug is deterministic once a large/contiguous IOPTE is unmapped with a request whose end falls inside that entry; this is attacker-influenced through mapping size, IOVA layout, and huge-page behavior. No uncontrollable race is required.\nPR:L - The attacker needs local access to an iommufd/VFIO device context, but such access can reasonably be delegated to an unprivileged VMM/container user and does not inherently require real init-namespace root. When uncertain between high and low privilege, low privilege is the higher severity choice.\nUI:N - After the attacker controls the local VFIO/iommufd context, triggering map and unmap operations requires no victim action. No user must open a file, mount media, or otherwise interact.\nS:C - The failure is an IOMMU/DMA invalidation error that can leave device DMA access beyond the kernel's intended mapping lifetime. That crosses the IOMMU isolation boundary and can affect resources outside the vulnerable component's security scope.\nC:H - A stale IOMMU translation can allow a device under attacker control to DMA-read physical pages after they are considered unmapped or potentially reused. This can expose arbitrary host or other-tenant memory in a plausible VFIO deployment.\nI:H - The same stale DMA translation can allow device DMA writes to pages no longer authorized for that mapping. Such writes can corrupt host memory or another security domain's data.\nA:H - Unauthorized stale DMA writes can corrupt kernel or device-owned memory and plausibly crash or hang the host. Even without full exploitation, this can produce high-impact denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/generic_pt/iommu_pt.h"], "versions": [{"version": "7c53f4238aa8bfb476e177263133ead2eeb8d55d", "lessThan": "50ecd96a28f712f8b682c0441f4cb9b086d28816", "status": "affected", "versionType": "git"}, {"version": "7c53f4238aa8bfb476e177263133ead2eeb8d55d", "lessThan": "ee6e69d032550687a3422504bfca3f834c7b5061", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/generic_pt/iommu_pt.h"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/50ecd96a28f712f8b682c0441f4cb9b086d28816"}, {"url": "https://git.kernel.org/stable/c/ee6e69d032550687a3422504bfca3f834c7b5061"}], "title": "iommupt: Fix short gather if the unmap goes into a large mapping", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iommu/generic_pt/iommu_pt.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "50ecd96a28f712f8b682c0441f4cb9b086d28816", "status": "affected", "version": "7c53f4238aa8bfb476e177263133ead2eeb8d55d", "versionType": "git"}, {"lessThan": "ee6e69d032550687a3422504bfca3f834c7b5061", "status": "affected", "version": "7c53f4238aa8bfb476e177263133ead2eeb8d55d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iommu/generic_pt/iommu_pt.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommupt: Fix short gather if the unmap goes into a large mapping\n\nunmap has the odd behavior that it can unmap more than requested if the\nending point lands within the middle of a large or contiguous IOPTE.\n\nIn this case the gather should flush everything unmapped which can be\nlarger than what was requested to be unmapped. The gather was only\nflushing the range requested to be unmapped, not extending to the extra\nrange, resulting in a short invalidation if the caller hits this special\ncondition.\n\nThis was found by the new invalidation/gather test I am adding in\npreparation for ARMv8. Claude deduced the root cause.\n\nAs far as I remember nothing relies on unmapping a large entry, so this is\nlikely not a triggerable bug."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niommupt: Corrige la recolecci\u00f3n corta si la desasignaci\u00f3n entra en un mapeo grande\n\nLa desasignaci\u00f3n tiene el comportamiento peculiar de que puede desasignar m\u00e1s de lo solicitado si el punto final cae dentro de la mitad de un IOPTE grande o contiguo.\n\nEn este caso, la recolecci\u00f3n deber\u00eda vaciar todo lo desasignado, lo cual puede ser mayor de lo que se solicit\u00f3 desasignar. La recolecci\u00f3n solo estaba vaciando el rango solicitado para desasignar, no extendi\u00e9ndose al rango adicional, lo que resultaba en una invalidaci\u00f3n corta si el llamador encuentra esta condici\u00f3n especial.\n\nEsto fue descubierto por la nueva prueba de invalidaci\u00f3n/recolecci\u00f3n que estoy a\u00f1adiendo en preparaci\u00f3n para ARMv8. Claude dedujo la causa ra\u00edz.\n\nPor lo que recuerdo, nada depende de la desasignaci\u00f3n de una entrada grande, por lo que es probable que este no sea un error activable."}], "id": "CVE-2026-31735", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-01T15:16:36.140", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/50ecd96a28f712f8b682c0441f4cb9b086d28816"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ee6e69d032550687a3422504bfca3f834c7b5061"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: iommupt: Fix short gather if the unmap goes into a large mapping", "id": "2464387", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464387"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-459", "details": ["A flaw was found in the Linux kernel's Input/Output Memory Management Unit (IOMMU) page table handling. When an unmap operation partially overlaps with a large memory mapping, the system's invalidation process may not correctly flush the entire unmapped range. This could result in a 'short invalidation,' where some memory remains improperly invalidated. While this issue could potentially lead to data integrity problems or information disclosure, it is currently considered unlikely to be a triggerable bug."], "name": "CVE-2026-31735", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31735\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31735\nhttps://lore.kernel.org/linux-cve-announce/2026050138-CVE-2026-31735-436c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c53f4238aa8bfb476e177263133ead2eeb8d55d,50ecd96a28f712f8b682c0441f4cb9b086d28816)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c53f4238aa8bfb476e177263133ead2eeb8d55d,ee6e69d032550687a3422504bfca3f834c7b5061)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.12,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T17:00:10.793026+00:00", "updated": "2026-05-07T19:00:11.702943+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}