Skip to main content

Linux Kernel CVE-2026-31405

| EUVDEUVD-2026-19199 CRITICAL
Out-of-bounds Read (CWE-125)
2026-04-06 Linux GHSA-qqxp-95qg-gqxr
Buffer Overflow Information Disclosure Linux
9.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.8 MEDIUM

Reachable only via an adjacent DVB/ULE broadcast feed (AV:A) on non-default DVB-net configs and needs a specific htype plus favorable memory (AC:H); most likely crash or control-flow hijack, so I/A high, confidentiality N.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 08:14 vuln.today
CVSS changed
Apr 27, 2026 - 14:22 NVD
9.8 (CRITICAL)
Patch available
Apr 16, 2026 - 05:29 EUVD
29ef43ceb121d67b87f4cbb08439e4e9e732eff8,1a6da3dbb9985d00743073a1cc1f96e59f5abc30,8bde543d2a5f935ba2a6a6325a2e02f8a9256fbe
EUVD ID Assigned
Apr 06, 2026 - 08:15 euvd
EUVD-2026-19199
CVE Published
Apr 06, 2026 - 07:33 cve.org
CRITICAL 9.8
CVE Published
Apr 06, 2026 - 07:33 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: dvb-net: fix OOB access in ULE extension header tables

The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables in handle_one_ule_extension() are declared with 255 elements (valid indices 0-254), but the index htype is derived from network-controlled data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When htype equals 255, an out-of-bounds read occurs on the function pointer table, and the OOB value may be called as a function pointer.

Add a bounds check on htype against the array size before either table is accessed. Out-of-range values now cause the SNDU to be discarded.

AnalysisAI

Out-of-bounds function-pointer read in the Linux kernel's DVB network (dvb-net) ULE decapsulation code allows a crafted MPEG-TS/ULE stream to index past the 255-element ule_mandatory_ext_handlers[]/ule_optional_ext_handlers[] tables when the extension header type equals 255, potentially invoking an arbitrary value as a function pointer. Affected systems are those using DVB adapters with the dvb-net ULE (Unidirectional Lightweight Encapsulation) path; the flaw is triggered by attacker-influenced network/broadcast data. No public exploit identified at time of analysis, EPSS is very low (0.01%), and the issue is not in CISA KEV, but the theoretical impact is control-flow hijack.

Technical ContextAI

The vulnerability lives in the DVB (Digital Video Broadcasting) networking subsystem's ULE (Unidirectional Lightweight Encapsulation, RFC 4326) receive path in drivers/media/dvb-core/dvb_net.c. ULE SNDUs (SubNetwork Data Units) can carry extension headers; handle_one_ule_extension() dispatches them through two static arrays of function pointers indexed by htype, where htype = ule_sndu_type & 0x00FF (range 0-255). Because the handler tables are sized for only 255 entries (indices 0-254), an htype of 255 reads one element beyond the array - CWE-125 (Out-of-bounds Read). Critically, the OOB-read value is then used as a function pointer and called, which elevates a read primitive into a potential control-flow-hijack condition on the affected function-pointer table. The tags also label this 'Buffer Overflow / Information Disclosure', but structurally it is an OOB read of a dispatch table.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9, or mainline 7.0-rc3 (or later) - which adds a bounds check on htype against the array size and discards out-of-range SNDUs. Distribution users should apply their vendor's fixed package; Ubuntu users see USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1) and reboot. Fix commits are at git.kernel.org (e.g. https://git.kernel.org/stable/c/24d87712727a5017ad142d63940589a36cd25647). If patching must be deferred, the effective compensating control is to avoid loading the DVB networking path: unbind/remove DVB tuner hardware or blacklist the dvb_net/dvb-core modules (modprobe blacklist) on systems that do not use DVB-over-IP, and do not run 'dvbnet' to create ule* interfaces - trade-off is loss of any DVB IP-datacast functionality on that host. Where DVB networking is required, restrict the receive path to trusted broadcast sources only, accepting that this does not eliminate the flaw for a malicious upstream feed.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31405 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy