Linux Kernel iavf CVE-2026-31505

Requires local authenticated access with privileges to execute ethtool commands (typically root, CAP_NET_ADMIN, or netdev group membership). System must be running affected Linux kernel version (5.17 through unpatched 6.12.x/6.18.x/6.19.x/7.0) with active iavf driver managing Intel SR-IOV virtual function network interfaces. Exploitation depends on precise race condition timing achieved by executing 'ethtool -L' (channel reconfiguration) concurrently with 'ethtool -S' (statistics query) on the same iavf interface. Attack complexity is low (AC:L) from privilege perspective but timing precision increases practical difficulty. Does NOT require specific non-default configurations of iavf itself, though presence of SR-IOV virtual functions is inherent to iavf usage. No user interaction required beyond attacker's own commands. Limiting factor: race window is narrow and requires sustained concurrent operations to reliably trigger, making opportunistic exploitation difficult without scripted automation and multiple attempts.

CVSS vector indicates local attack requiring low privileges and no user interaction (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with 7.8 base score, suggesting significant impact if exploited. However, real-world risk is substantially lower based on convergent signals: EPSS probability of 0.02% (5th percentile) indicates minimal likelihood of widespread exploitation, no public exploit code exists, and CISA KEV does not list this vulnerability. The attack requires precise race condition timing between concurrent ethtool operations on the same iavf interface, which is operationally unlikely in production environments where network configuration changes are infrequent and administrative. Exploitation is further limited to local authenticated users with sufficient privileges to execute ethtool commands (typically root or CAP_NET_ADMIN). The vulnerability's discovery via KASAN testing rather than in-the-wild observation suggests low exploitability. While the integrity and availability impacts could enable local privilege escalation or denial of service in theory, practical exploitation faces significant timing constraints. Priority should be moderate for systems running affected kernel versions with iavf-enabled virtualized environments, particularly where multiple administrators perform concurrent network tuning operations.

A local attacker with low-privilege access (e.g., member of netdev group or CAP_NET_ADMIN capability) on a virtualized Linux system using Intel SR-IOV initiates rapid channel reconfiguration via 'ethtool -L eth0 combined 8' while simultaneously scripting repeated 'ethtool -S eth0' statistics queries in a tight loop. The attacker times operations to exploit the race window between num_active_queues update and real_num_tx_queues synchronization, triggering out-of-bounds writes to vmalloc regions. By carefully crafting the timing and controlling the overflow content through specific queue configurations, the attacker could potentially corrupt adjacent kernel memory structures, leading to privilege escalation or denial of service. The KASAN detection mechanism in the description suggests detection in hardened kernels, but production systems without memory safety instrumentation remain vulnerable to silent memory corruption.