Skip to main content

Linux Kernel CVE-2026-31430

| EUVDEUVD-2026-23819 HIGH
Out-of-bounds Read (CWE-125)
2026-04-20 Linux GHSA-q7h9-pvj5-g9fp
Information Disclosure Linux Buffer Overflow Red Hat Suse
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
6.6 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
May 21, 2026 - 15:37 vuln.today
CVSS changed
May 21, 2026 - 15:37 NVD
7.1 (HIGH)
Patch released
Apr 23, 2026 - 16:17 nvd
Patch available
Patch available
Apr 20, 2026 - 11:16 EUVD
EUVD ID Assigned
Apr 20, 2026 - 10:15 euvd
EUVD-2026-23819
CVE Published
Apr 20, 2026 - 09:43 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

X.509: Fix out-of-bounds access when parsing extensions

Leo reports an out-of-bounds access when parsing a certificate with empty Basic Constraints or Key Usage extension because the first byte of the extension is read before checking its length. Fix it.

The bug can be triggered by an unprivileged user by submitting a specially crafted certificate to the kernel through the keyrings(7) API. Leo has demonstrated this with a proof-of-concept program responsibly disclosed off-list.

AnalysisAI

Out-of-bounds read in the Linux kernel's X.509 certificate parser allows local unprivileged users to trigger memory corruption or denial of service by submitting a specially crafted certificate via the keyrings(7) API. The flaw exists in the handling of empty Basic Constraints or Key Usage extensions, where the first byte is dereferenced before the length check. A proof-of-concept was responsibly disclosed by the reporter, though no public exploit is identified at time of analysis and EPSS rates the exploitation probability as very low (0.01%).

Technical ContextAI

The vulnerability resides in the Linux kernel's X.509 certificate parsing code (crypto/asymmetric_keys/x509_cert_parser.c), which decodes ASN.1-encoded certificate extensions. When parsing Basic Constraints or Key Usage extensions, the parser reads the first byte of the extension value before validating that the extension contains any data, leading to an out-of-bounds read past the buffer boundary. This is a classic CWE-125 (Out-of-bounds Read) issue. The keyrings(7) syscall interface is the attack surface: it permits unprivileged user-space processes to feed arbitrary certificate bytes directly into the in-kernel parser, making this a reachable code path without elevated privileges or special configuration.

RemediationAI

Vendor-released patch: upgrade to Linux kernel 6.6.135, 6.12.82, 6.18.23, 6.19.13, or later as appropriate for your stable branch, per the fix commits at https://git.kernel.org/stable/c/672b526def1f94c1be8eb11b885b803da0d8c2f1 and the related commits (206121294b9cf27f0589857f80d64f87e496ffb2, 30ab358fad0c7daa1d282ec48089901b21b36a20, 7fb4dadc2734f4020d7543d688b8d49c8e569c61, d702c3408213bb12bd570bb97204d8340d141c51). On distributions, apply the kernel update from your vendor (RHEL, Ubuntu, SUSE, Debian) once available and reboot. As a compensating control until patched, restrict access to the keyrings API by using seccomp filters to block the add_key(2) and keyctl(2) syscalls for untrusted workloads or containers (note: this will break legitimate consumers such as kerberos and fscrypt), and avoid granting shell access to untrusted local users on shared hosts.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2016-1646 HIGH POC
8.8
CVE-2025-5777 HIGH POC
7.5
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31430 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy