Skip to main content

Linux Kernel CVE-2026-31649

| EUVDEUVD-2026-25542 CRITICAL
Integer Overflow or Wraparound (CWE-190)
2026-04-24 Linux GHSA-jv6m-v86w-343p
Buffer Overflow Linux Integer Overflow
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE
CRITICAL
qualitative
Red Hat
6.0 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

8
Re-analysis Queued
Apr 27, 2026 - 20:22 vuln.today
cvss_changed
Patch released
Apr 27, 2026 - 20:13 nvd
Patch available
Analysis Generated
Apr 27, 2026 - 15:41 vuln.today
CVSS changed
Apr 27, 2026 - 15:22 NVD
9.8 (CRITICAL)
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25542
Analysis Generated
Apr 24, 2026 - 15:00 vuln.today
CVE Published
Apr 24, 2026 - 14:45 nvd
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix integer underflow in chain mode

The jumbo_frm() chain-mode implementation unconditionally computes

len = nopaged_len - bmax;

where nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is BUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit() decides to invoke jumbo_frm() based on skb->len (total length including page fragments):

is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc);

When a packet has a small linear portion (nopaged_len <= bmax) but a large total length due to page fragments (skb->len > bmax), the subtraction wraps as an unsigned integer, producing a huge len value (~0xFFFFxxxx). This causes the while (len != 0) loop to execute hundreds of thousands of iterations, passing skb->data + bmax * i pointers far beyond the skb buffer to dma_map_single(). On IOMMU-less SoCs (the typical deployment for stmmac), this maps arbitrary kernel memory to the DMA engine, constituting a kernel memory disclosure and potential memory corruption from hardware.

Fix this by introducing a buf_len local variable clamped to min(nopaged_len, bmax). Computing len = nopaged_len - buf_len is then always safe: it is zero when the linear portion fits within a single descriptor, causing the while (len != 0) loop to be skipped naturally, and the fragment loop in stmmac_xmit() handles page fragments afterward.

AnalysisAI

Integer underflow in Linux kernel stmmac network driver allows kernel memory disclosure and potential corruption via crafted network packets. The flaw occurs in chain mode jumbo frame handling when packets have small linear data but large total length from page fragments, causing buffer offset calculations to wrap to ~0xFFFFxxxx. This triggers massive loop iterations that DMA-map arbitrary kernel memory to the network hardware. On typical stmmac deployments (IOMMU-less embedded SoCs), attackers can remotely read kernel memory contents and potentially corrupt memory through hardware DMA operations. EPSS exploitation probability is low (0.02%) with no confirmed active exploitation, but CVSS 9.8 reflects the theoretical remote unauthenticated attack surface. Vendor patches available across all supported stable kernel branches (5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, 7.0).

Technical ContextAI

The stmmac (ST Microelectronics MAC) Ethernet driver implements jumbo frame transmission using descriptor chains. The vulnerability exists in the jumbo_frm() function which performs unsigned integer arithmetic: len = nopaged_len - bmax, where nopaged_len is the linear portion of an sk_buff (skb_headlen) and bmax is the descriptor buffer size (8KiB or 2KiB). The parent function stmmac_xmit() decides whether to invoke jumbo_frm() based on total packet length (skb->len including paged fragments), creating a logic gap. When sk_buff structures contain minimal linear data but substantial page fragments (common in zero-copy networking and TCP segmentation offload), nopaged_len can be smaller than bmax while total skb->len exceeds the jumbo threshold. The resulting unsigned underflow produces values approaching UINT_MAX, causing a while(len != 0) loop to iterate hundreds of thousands of times. Each iteration calls dma_map_single() with incrementally offset pointers (skb->data + bmax * i) that extend far beyond the actual skb buffer boundaries. On embedded ARM/MIPS SoCs using stmmac without IOMMUs (typical for automotive, industrial, and networking appliances), these out-of-bounds DMA mappings directly expose kernel memory to the network hardware, creating both confidentiality (memory reads) and integrity (DMA writes) vulnerabilities. Affected CPE strings confirm impact across all Linux kernel versions containing commit 286a837217204b1ef105e3a554d0757e4fdfaac1 (introduced in 3.2 era) through current mainline.

RemediationAI

Apply vendor-released kernel patches immediately for affected stable branches: upgrade to Linux 5.10.253+ (commit 51f4e090b9f87b40c21b6daadb5c06e6c0a07b67), 5.15.203+ (commit 2c91b39912278d0878f9ba60ba04d2518b18a08d), 6.1.169+ (commit 513e06735f5be575b409d195822195348b164e48), 6.6.135+ (commit b7b8012193fd98236d7ae05d4b553f010a77b2ef), 6.12.82+ (commit 6fca757c20396dc2e604dcc61922264e9e3dc803), 6.18.23+ (commit a2b68a9a476b9544ff31f1fbcd5d80867a8a5e2f), 6.19.13+ (commit 10d12b9240ebf96c785f0e2e4228318cd5f3a3eb), or mainline 7.0+ (commit 275bdf762e82082f064e60a92448fa2ac43cf95b). Full patch commit history available at https://git.kernel.org/stable/ references. For systems unable to immediately patch: (1) Disable jumbo frame support on stmmac interfaces via ethtool -G <interface> rx <standard_MTU> tx <standard_MTU> to force standard 1500-byte MTU, eliminating jumbo_frm() code path entirely (side effect: reduced throughput for large transfers, breaks protocols requiring jumbo frames). (2) Enable IOMMU support if hardware provides it (Intel VT-d, ARM SMMU) to sandbox DMA operations, preventing kernel memory exposure even if underflow occurs (configuration complexity, potential performance impact). (3) Implement network segmentation to restrict stmmac interface exposure to trusted networks only, reducing remote attack surface (does not prevent attacks from compromised trusted clients). Verify patch application by checking kernel version with uname -r and confirming stmmac module version matches patched commits.

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8
CVE-2013-3940 CRITICAL
9.3

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31649 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy