CVE-2026-31649
Linux kernel (Xilinx ZynqMP) vulnerabilities
Description
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix integer underflow in chain mode The jumbo_frm() chain-mode implementation unconditionally computes len = nopaged_len - bmax; where nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is BUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit() decides to invoke jumbo_frm() based on skb->len (total length including page fragments): is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc); When a packet has a small linear portion (nopaged_len <= bmax) but a large total length due to page fragments (skb->len > bmax), the subtraction wraps as an unsigned integer, producing a huge len value (~0xFFFFxxxx). This causes the while (len != 0) loop to execute hundreds of thousands of iterations, passing skb->data + bmax * i pointers far beyond the skb buffer to dma_map_single(). On IOMMU-less SoCs (the typical deployment for stmmac), this maps arbitrary kernel memory to the DMA engine, constituting a kernel memory disclosure and potential memory corruption from hardware. Fix this by introducing a buf_len local variable clamped to min(nopaged_len, bmax). Computing len = nopaged_len - buf_len is then always safe: it is zero when the linear portion fits within a single descriptor, causing the while (len != 0) loop to be skipped naturally, and the fragment loop in stmmac_xmit() handles page fragments afterward.
Metrics
Affected operating systems
linux
amazon / amazon_linux
linux
ubuntu / awsbionic
linux
ubuntu / awsjammy
linux
ubuntu / awsnoble
linux
ubuntu / awsresolute
linux
ubuntu / awsxenial
linux
ubuntu / aws-6.8jammy
linux
ubuntu / aws-hwexenial
linux
ubuntu / azurejammy
linux
ubuntu / azurenoble
linux
ubuntu / azureresolute
linux
ubuntu / azurexenial
linux
ubuntu / azure-4.15bionic
linux
suse / basesystem_module15
linux
debian / debian_linux11.0
linux
debian / debian_linux12.0
linux
debian / debian_linux13.0
linux
suse / development_tools_module15
linux
redhat / enterprise_linux10.0
linux
redhat / enterprise_linux8.0
linux
redhat / enterprise_linux9.0
linux
redhat / enterprise_linux_aus8.4
linux
redhat / enterprise_linux_aus8.6
linux
redhat / enterprise_linux_eus10.0
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
arista
cloudvision_agni2024.4.0 – 2025.2.2
arista
cloudvision_portal2024.2.0 – 2026.1.0
arista
velocloud_edge4.5.0 – 6.4.1
arista
velocloud_gateway
arista
velocloud_orchestrator
IBM
QRadar SIEM<7.5.0 UP15 IF06
redhat
openshift_container_platform4.12 – 4.12.89
redhat
openshift_container_platform4.13 – 4.13.66
redhat
openshift_container_platform4.14 – 4.14.65
redhat
openshift_container_platform4.15 – 4.15.64
redhat
openshift_container_platform4.16 – 4.16.61
redhat
openshift_container_platform4.17 – 4.17.53
redhat
openshift_container_platform4.18 – 4.18.40
redhat
openshift_container_platform4.19 – 4.19.30
redhat
openshift_container_platform4.20 – 4.20.21
redhat
openshift_container_platform4.21 – 4.21.14
redhat
openshift_container_platform
siemens
simatic_ax_runtime
suse
caas_platform
suse
enterprise_storage
suse
manager_proxy
suse
manager_retail_branch_server
suse
manager_server
suse
openstack_cloud
References & sources
- https://git.kernel.org/stable/c/414fc5e5a5aff776c150f1b86770e0a25a35df3aeuvd
- https://git.kernel.org/stable/c/02f3ecadb23558bbe068e6504118f1b712d4ece0euvd
- https://git.kernel.org/stable/c/0e43e0a3c94044acc74b8e0927c27972eb5a59e8euvd
- https://git.kernel.org/stable/c/aa9facde6c5005205874c37db3fd25799d741bafeuvd
- https://git.kernel.org/stable/c/5d70eb25b41e9b010828cd12818b06a0c3b04412euvd
- https://git.kernel.org/stable/c/2694d408b0e595024e0fc1d64ff9db0358580f74euvd
- https://git.kernel.org/stable/c/a9b8b18364fffce4c451e6f6fd218fa4ab646705euvd
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://git.kernel.org/stable/c/343fe375a8dd6ee51a193a1c233b999f5ea4d479
- https://git.kernel.org/stable/c/782acde47e127c98a113726e2ff8024bd65c0454
- https://git.kernel.org/stable/c/c3db89ea1ed3d540eebe8f3c36e806fb75ee4a1e
- https://git.kernel.org/stable/c/5b5228964619b180f366940505b77255b1a03929
- https://git.kernel.org/stable/c/857aefc70d4ae3b9bf1ae67434d27d0f79f80c9e
- https://git.kernel.org/stable/c/bea3e1d4467bcf292c8e54f080353d556d355e26
- https://git.kernel.org/stable/c/2ae0afd98432536562fa8261538ae795446f0589euvd
- https://git.kernel.org/stable/c/408e85ee708b6aa03eeb0220ffa0915f4d407181euvd
- https://git.kernel.org/stable/c/b7df9fbd4869fdfe09a3f501ffd228486521e062euvd
- https://git.kernel.org/stable/c/8517b6c8d2c759918ba0058cb6c7e14d59643202euvd
- https://git.kernel.org/stable/c/1c439de70b1c3eb3c6bffa8245c16b9fc318f114euvd
Linked CVEs
- CVE-2026-46333
In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of…
highCVSSv3 7.1 - CVE-2026-46300
A flaw was found in the Linux kernel's XFRM ESP-in-TCP subsystem.
highCVSSv3 7.8 - CVE-2026-46243
A privilege escalation vulnerability was found in the Linux kernel's CIFS client implementation.
highCVSSv3 7.8 - CVE-2026-46195
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers pars…
criticalCVSSv3 9.8 - CVE-2026-46135
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet…
criticalCVSSv3 9.8 - CVE-2026-46119
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix slab-out-of-bounds access in auth message processing I…
criticalCVSSv3 9.1 - CVE-2026-46043
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rx…
criticalCVSSv3 9.1 - CVE-2026-46028
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - snapshot IV for async AEAD requests AF_ALG AEA…
—CVSSv3 0.0 - CVE-2026-45988
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet g…
criticalCVSSv3 9.8 - CVE-2026-43503
A flaw was found in the Linux kernel's networking (skbuff) component.
highCVSSv3 8.8 - CVE-2026-43501
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv…
criticalCVSSv3 9.8 - CVE-2026-43500
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are prese…
highCVSSv3 7.8 - CVE-2026-43494
In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_…
highCVSSv3 7.8 - CVE-2026-43493
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG r…
criticalCVSSv3 9.8 - CVE-2026-43414
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcm…
criticalCVSSv3 9.8 - CVE-2026-43407
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_repl…
criticalCVSSv3 9.1 - CVE-2026-43406
In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in process_message_he…
criticalCVSSv3 9.1 - CVE-2026-43383
In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-time To prevent timi…
criticalCVSSv3 9.4 - CVE-2026-43341
In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill ioa…
criticalCVSSv3 9.8 - CVE-2026-43304
In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key,…
criticalCVSSv3 9.8 - CVE-2026-43284
A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems.
highCVSSv3 8.8 - CVE-2026-43186
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() O…
criticalCVSSv3 9.8 - CVE-2026-43117
In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: get correct superblock from dentry in event btrf…
criticalCVSSv3 9.1 - CVE-2026-43114
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on e…
criticalCVSSv3 9.4
Show 57 more CVEs
- CVE-2026-43078
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl…
highCVSSv3 7.8 - CVE-2026-43077
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Fix minimum RX size check for decryption The c…
—CVSSv3 0.0 - CVE-2026-43071
In the Linux kernel, the following vulnerability has been resolved: dcache: Limit the minimal number of bucket to two There is an OOB r…
criticalCVSSv3 9.1 - CVE-2026-43038
In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashik…
criticalCVSSv3 9.8 - CVE-2026-43037
A flaw was found in the Linux kernel's IPv6 tunnel implementation.
criticalCVSSv3 9.8 - CVE-2026-43033
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-pla…
highCVSSv3 7.8 - CVE-2026-43011
In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x…
criticalCVSSv3 9.8 - CVE-2026-31685
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets `e…
criticalCVSSv3 9.4 - CVE-2026-31682
In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_s…
criticalCVSSv3 9.1 - CVE-2026-31669
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The eha…
criticalCVSSv3 9.8 - CVE-2026-31668
In the Linux kernel, the following vulnerability has been resolved: seg6: separate dst_cache for input and output paths in seg6 lwtunnel…
criticalCVSSv3 9.8 - CVE-2026-31659
In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject oversized global TT response buffers batadv_tt_p…
criticalCVSSv3 9.8 - CVE-2026-31657
In the Linux kernel, the following vulnerability has been resolved: batman-adv: hold claim backbone gateways by reference batadv_bla_ad…
criticalCVSSv3 9.8 - CVE-2026-31637
In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ti…
criticalCVSSv3 9.8 - CVE-2026-31607
In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a…
criticalCVSSv3 9.8 - CVE-2026-31533
In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryptio…
criticalCVSSv3 9.8 - CVE-2026-31504
In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_…
highCVSSv3 7.8 - CVE-2026-31478
In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_o…
criticalCVSSv3 9.8 - CVE-2026-31431Actively exploited
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly r…
criticalCVSSv3 7.8 - CVE-2026-31419
In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit…
highCVSSv3 7.8 - CVE-2026-31418
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: drop logically empty buckets in mtype_del mtype_d…
mediumCVSSv3 5.5 - CVE-2026-31402
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 re…
criticalCVSSv3 9.8 - CVE-2026-23455
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()…
criticalCVSSv3 9.1 - CVE-2026-23450
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Sy…
criticalCVSSv3 9.8 - CVE-2026-23428
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of share_conf in compound request smb2_ge…
criticalCVSSv3 9.8 - CVE-2026-23351
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Y…
highCVSSv3 7.8 - CVE-2026-23278
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always walk all pending catchall elements Dur…
highCVSSv3 7.8 - CVE-2026-23274
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels ID…
highCVSSv3 7.8 - CVE-2026-23272
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unconditionally bump set->nelems before insert…
highCVSSv3 7.8 - CVE-2026-23262
In the Linux kernel, the following vulnerability has been resolved: gve: Fix stats report corruption on queue count change The driver a…
—CVSSv3 0.0 - CVE-2026-23258
In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Initialize netdev pointer before queue setup In setu…
—CVSSv3 0.0 - CVE-2026-23257
In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanu…
—CVSSv3 0.0 - CVE-2026-23256
In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanu…
—CVSSv3 0.0 - CVE-2026-23216
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_cou…
—CVSSv3 0.0 - CVE-2026-23206
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero…
—CVSSv3 0.0 - CVE-2026-23202
In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfe…
—CVSSv3 0.0 - CVE-2026-23198
In the Linux kernel, the following vulnerability has been resolved: KVM: Don't clobber irqfd routing type when deassigning irqfd When d…
highCVSSv3 7.8 - CVE-2026-23193
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_…
highCVSSv3 8.8 - CVE-2026-23190
In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: fix memory leak in acp3x pdm dma ops
—CVSSv3 0.0 - CVE-2026-23182
In the Linux kernel, the following vulnerability has been resolved: spi: tegra: Fix a memory leak in tegra_slink_probe() In tegra_slink…
—CVSSv3 0.0 - CVE-2026-23180
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: add bounds check for if_id in IRQ handler The IRQ han…
highCVSSv3 7.0 - CVE-2026-23176
In the Linux kernel, the following vulnerability has been resolved: platform/x86: toshiba_haps: Fix memory leaks in add/remove routines…
—CVSSv3 0.0 - CVE-2025-71224
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: ocb: skip rx_no_sta when interface is not joined ie…
—CVSSv3 0.0 - CVE-2025-71222
In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: ensure skb headroom before skb_push This avoids occas…
—CVSSv3 0.0 - CVE-2025-71220
In the Linux kernel, the following vulnerability has been resolved: smb/server: call ksmbd_session_rpc_close() on error path in create_s…
—CVSSv3 0.0 - CVE-2025-71089
In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale I…
highCVSSv3 7.8 - CVE-2025-68263
In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request ipc_msg_send…
criticalCVSSv3 9.8 - CVE-2025-68214
In the Linux kernel, the following vulnerability has been resolved: timers: Fix NULL function pointer race in timer_shutdown_sync() The…
—CVSSv3 0.0 - CVE-2025-40082
In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() BUG: KASA…
highCVSSv3 7.1 - CVE-2025-38201
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX…
highCVSSv3 7.8 - CVE-2025-37924
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in kerberos authentication Setting sess->…
criticalCVSSv3 9.8 - CVE-2025-37822
In the Linux kernel, the following vulnerability has been resolved: riscv: uprobes: Add missing fence.i after building the XOL buffer T…
highCVSSv3 7.8 - CVE-2025-37778
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krb_authenticate krb_authenticate fr…
criticalCVSSv3 9.8 - CVE-2024-50060
In the Linux kernel, the following vulnerability has been resolved: io_uring: check if we need to reschedule during overflow flush In t…
—CVSSv3 0.0 - CVE-2024-35862
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_network_name_deleted() Sk…
criticalCVSSv3 9.8 - CVE-2023-53673
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: call disconnect callback before deleting conn…
highCVSSv3 8.8 - CVE-2022-48816
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: lock against ->sock changing during sysfs read ->sock can b…
highCVSSv3 7.8