GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-31505 (GCVE-0-2026-31505)

Vulnerability from cvelistv5 – Published: 2026-04-22 13:54 – Updated: 2026-08-05 12:23
VLAI
Title
iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
Summary
In the Linux kernel, the following vulnerability has been resolved: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() iavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the value could change in runtime, we should use num_tx_queues instead. Moreover iavf_get_ethtool_stats() uses num_active_queues while iavf_get_sset_count() and iavf_get_stat_strings() use real_num_tx_queues, which triggers out-of-bounds writes when we do "ethtool -L" and "ethtool -S" simultaneously [1]. For example when we change channels from 1 to 8, Thread 3 could be scheduled before Thread 2, and out-of-bounds writes could be triggered in Thread 3: Thread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S) iavf_set_channels() ... iavf_alloc_queues() -> num_active_queues = 8 iavf_schedule_finish_config() iavf_get_sset_count() real_num_tx_queues: 1 -> buffer for 1 queue iavf_get_ethtool_stats() num_active_queues: 8 -> out-of-bounds! iavf_finish_config() -> real_num_tx_queues = 8 Use immutable num_tx_queues in all related functions to avoid the issue. [1] BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270 Write of size 8 at addr ffffc900031c9080 by task ethtool/5800 CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x6f/0xb0 print_report+0x170/0x4f3 kasan_report+0xe1/0x180 iavf_add_one_ethtool_stat+0x200/0x270 iavf_get_ethtool_stats+0x14c/0x2e0 __dev_ethtool+0x3d0c/0x5830 dev_ethtool+0x12d/0x270 dev_ioctl+0x53c/0xe30 sock_do_ioctl+0x1a9/0x270 sock_ioctl+0x3d4/0x5e0 __x64_sys_ioctl+0x137/0x1c0 do_syscall_64+0xf3/0x690 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7da0e6e36d ... </TASK> The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88813a013de0 pfn:0x13a013 flags: 0x200000000000000(node=0|zone=2) raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d , < 1f931dee5b726df1940348ec31614d64bac03aa6 (git)
Affected: 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d , < bb85741d2dc2be207353a412f51b83697fcbefcf (git)
Affected: 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d , < fdf902bf86a80bf15792a1d20a67a5302498d7f1 (git)
Affected: 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d , < fecacfc95f195b99c71c579a472120d0b4ed65fa (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.12.80 , ≤ 6.12.* (semver)
Unaffected: 6.18.21 , ≤ 6.18.* (semver)
Unaffected: 6.19.11 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/iavf/iavf_ethtool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1f931dee5b726df1940348ec31614d64bac03aa6",
              "status": "affected",
              "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d",
              "versionType": "git"
            },
            {
              "lessThan": "bb85741d2dc2be207353a412f51b83697fcbefcf",
              "status": "affected",
              "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d",
              "versionType": "git"
            },
            {
              "lessThan": "fdf902bf86a80bf15792a1d20a67a5302498d7f1",
              "status": "affected",
              "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d",
              "versionType": "git"
            },
            {
              "lessThan": "fecacfc95f195b99c71c579a472120d0b4ed65fa",
              "status": "affected",
              "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/iavf/iavf_ethtool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\n\niavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the\nvalue could change in runtime, we should use num_tx_queues instead.\n\nMoreover iavf_get_ethtool_stats() uses num_active_queues while\niavf_get_sset_count() and iavf_get_stat_strings() use\nreal_num_tx_queues, which triggers out-of-bounds writes when we do\n\"ethtool -L\" and \"ethtool -S\" simultaneously [1].\n\nFor example when we change channels from 1 to 8, Thread 3 could be\nscheduled before Thread 2, and out-of-bounds writes could be triggered\nin Thread 3:\n\nThread 1 (ethtool -L)       Thread 2 (work)        Thread 3 (ethtool -S)\niavf_set_channels()\n...\niavf_alloc_queues()\n-\u003e num_active_queues = 8\niavf_schedule_finish_config()\n                                                   iavf_get_sset_count()\n                                                   real_num_tx_queues: 1\n                                                   -\u003e buffer for 1 queue\n                                                   iavf_get_ethtool_stats()\n                                                   num_active_queues: 8\n                                                   -\u003e out-of-bounds!\n                            iavf_finish_config()\n                            -\u003e real_num_tx_queues = 8\n\nUse immutable num_tx_queues in all related functions to avoid the issue.\n\n[1]\n BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270\n Write of size 8 at addr ffffc900031c9080 by task ethtool/5800\n\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x6f/0xb0\n  print_report+0x170/0x4f3\n  kasan_report+0xe1/0x180\n  iavf_add_one_ethtool_stat+0x200/0x270\n  iavf_get_ethtool_stats+0x14c/0x2e0\n  __dev_ethtool+0x3d0c/0x5830\n  dev_ethtool+0x12d/0x270\n  dev_ioctl+0x53c/0xe30\n  sock_do_ioctl+0x1a9/0x270\n  sock_ioctl+0x3d4/0x5e0\n  __x64_sys_ioctl+0x137/0x1c0\n  do_syscall_64+0xf3/0x690\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f7da0e6e36d\n ...\n  \u003c/TASK\u003e\n\n The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830\n The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff88813a013de0 pfn:0x13a013\n flags: 0x200000000000000(node=0|zone=2)\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n  ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n \u003effffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n                    ^\n  ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n  ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached locally through `ioctl(SIOCETHTOOL)` on a socket, specifically `ETHTOOL_GSTATS` calling the iavf ethtool statistics callback. Remote packets may influence counter values but do not directly invoke the vulnerable code.\nAC:L - The bug is a race between attacker-issued channel reconfiguration and stats retrieval; the attacker can repeatedly run `ethtool -L` and `ethtool -S` to hit the window before `finish_config` updates `real_num_tx_queues`. No rare external condition is required.\nPR:L - `ETHTOOL_GSTATS` is allowed to any local user, but reliably creating the mismatched queue-count state requires `ETHTOOL_SCHANNELS`, gated by `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`. In plausible delegated VF/container netns deployments this is a low namespace privilege rather than real init-namespace root.\nUI:N - No victim action is required when the attacker has the needed local namespace capability; the attacker can issue both ethtool operations directly. The vulnerable stats read itself is synchronous from the attacker\u2019s ioctl.\nS:U - The corruption occurs inside the same kernel security authority as the vulnerable network driver. This is standard kernel memory corruption/privilege escalation, not a VM escape or IOMMU boundary bypass.\nC:H - The flaw is an out-of-bounds kernel write in a vmalloc-backed stats buffer, which is memory corruption that can plausibly be leveraged during exploitation for information disclosure. Under the required conservative rule, this is High.\nI:H - The vulnerable function writes attacker-influenced u64 statistics past the allocated buffer when queue counts diverge. Out-of-bounds kernel writes are treated as high integrity impact because they can corrupt kernel memory and potentially enable code execution.\nA:H - The reported failure is a KASAN vmalloc-out-of-bounds write in kernel context, and the same corruption can oops or panic the kernel. The trigger can be repeated by local ethtool calls."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:08.072Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1f931dee5b726df1940348ec31614d64bac03aa6"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb85741d2dc2be207353a412f51b83697fcbefcf"
        },
        {
          "url": "https://git.kernel.org/stable/c/fdf902bf86a80bf15792a1d20a67a5302498d7f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/fecacfc95f195b99c71c579a472120d0b4ed65fa"
        }
      ],
      "title": "iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31505",
    "datePublished": "2026-04-22T13:54:24.524Z",
    "dateReserved": "2026-03-09T15:48:24.105Z",
    "dateUpdated": "2026-08-05T12:23:08.072Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31505",
      "date": "2026-09-17",
      "epss": "0.00129",
      "percentile": "0.0287"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T14:11:12.000Z",
      "cve": "CVE-2026-31505",
      "id": "msrc_CVE-2026-31505",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "product_status:known_affected": "7",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31505.json",
      "version": "9"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31505\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-22T14:16:49.233\",\"lastModified\":\"2026-06-17T10:33:52.370\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\\n\\niavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the\\nvalue could change in runtime, we should use num_tx_queues instead.\\n\\nMoreover iavf_get_ethtool_stats() uses num_active_queues while\\niavf_get_sset_count() and iavf_get_stat_strings() use\\nreal_num_tx_queues, which triggers out-of-bounds writes when we do\\n\\\"ethtool -L\\\" and \\\"ethtool -S\\\" simultaneously [1].\\n\\nFor example when we change channels from 1 to 8, Thread 3 could be\\nscheduled before Thread 2, and out-of-bounds writes could be triggered\\nin Thread 3:\\n\\nThread 1 (ethtool -L)       Thread 2 (work)        Thread 3 (ethtool -S)\\niavf_set_channels()\\n...\\niavf_alloc_queues()\\n-\u003e num_active_queues = 8\\niavf_schedule_finish_config()\\n                                                   iavf_get_sset_count()\\n                                                   real_num_tx_queues: 1\\n                                                   -\u003e buffer for 1 queue\\n                                                   iavf_get_ethtool_stats()\\n                                                   num_active_queues: 8\\n                                                   -\u003e out-of-bounds!\\n                            iavf_finish_config()\\n                            -\u003e real_num_tx_queues = 8\\n\\nUse immutable num_tx_queues in all related functions to avoid the issue.\\n\\n[1]\\n BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270\\n Write of size 8 at addr ffffc900031c9080 by task ethtool/5800\\n\\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n Call Trace:\\n  \u003cTASK\u003e\\n  dump_stack_lvl+0x6f/0xb0\\n  print_report+0x170/0x4f3\\n  kasan_report+0xe1/0x180\\n  iavf_add_one_ethtool_stat+0x200/0x270\\n  iavf_get_ethtool_stats+0x14c/0x2e0\\n  __dev_ethtool+0x3d0c/0x5830\\n  dev_ethtool+0x12d/0x270\\n  dev_ioctl+0x53c/0xe30\\n  sock_do_ioctl+0x1a9/0x270\\n  sock_ioctl+0x3d4/0x5e0\\n  __x64_sys_ioctl+0x137/0x1c0\\n  do_syscall_64+0xf3/0x690\\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n RIP: 0033:0x7f7da0e6e36d\\n ...\\n  \u003c/TASK\u003e\\n\\n The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830\\n The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000\\n index:0xffff88813a013de0 pfn:0x13a013\\n flags: 0x200000000000000(node=0|zone=2)\\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\\n page dumped because: kasan: bad access detected\\n\\n Memory state around the buggy address:\\n  ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\\n  ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n \u003effffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\\n                    ^\\n  ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\\n  ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/intel/iavf/iavf_ethtool.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d\",\"lessThan\":\"1f931dee5b726df1940348ec31614d64bac03aa6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d\",\"lessThan\":\"bb85741d2dc2be207353a412f51b83697fcbefcf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d\",\"lessThan\":\"fdf902bf86a80bf15792a1d20a67a5302498d7f1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d\",\"lessThan\":\"fecacfc95f195b99c71c579a472120d0b4ed65fa\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/intel/iavf/iavf_ethtool.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.80\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.21\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.11\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17.1\",\"versionEndExcluding\":\"6.12.80\",\"matchCriteriaId\":\"803A2BAF-5A16-46AC-B6F6-5128B48C13FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.21\",\"matchCriteriaId\":\"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.11\",\"matchCriteriaId\":\"4CA2E747-A9EC-4518-9AA2-B4247FC748B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A59F7FD3-F505-48BD-8875-F07A33F42F6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"512EE3A8-A590-4501-9A94-5D4B268D6138\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1f931dee5b726df1940348ec31614d64bac03aa6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bb85741d2dc2be207353a412f51b83697fcbefcf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fdf902bf86a80bf15792a1d20a67a5302498d7f1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fecacfc95f195b99c71c579a472120d0b4ed65fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T17:14:16+00:00",
      "cve": "CVE-2026-31505",
      "id": "CVE-2026-31505",
      "initial_release_date": "2026-04-22T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31505.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-11T01:31:20Z",
      "cve": "CVE-2026-31505",
      "id": "CVE-2026-31505",
      "initial_release_date": "2026-04-23T01:25:15Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "226",
      "product_status:recommended": "538",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31505",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31505.json",
      "version": "34"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.