cbcvebase.
CVE-2026-31494
published 2026-04-22

CVE-2026-31494: In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats There's a potential mismatch between the…

PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
3.4th percentile
In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats There's a potential mismatch between the memory reserved for statistics and the amount of memory written. gem_get_sset_count() correctly computes the number of stats based on the active queues, whereas gem_get_ethtool_stats() indiscriminately copies data using the maximum number of queues, and in the case the number of active queues is less than MACB_MAX_QUEUES, this results in a OOB write as observed in the KASAN splat. BUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78 [macb] Write of size 760 at addr ffff80008080b000 by task ethtool/1027 CPU: [...] Tainted: [E]=UNSIGNED_MODULE Hardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025 Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x80/0xf8 print_report+0x384/0x5e0 kasan_report+0xa0/0xf0 kasan_check_range+0xe8/0x190 __asan_memcpy+0x54/0x98 gem_get_ethtool_stats+0x54/0x78 [macb 926c13f3af83b0c6fe64badb21ec87d5e93fcf65] dev_ethtool+0x1220/0x38c0 dev_ioctl+0x4ac/0xca8 sock_do_ioctl+0x170/0x1d8 sock_ioctl+0x484/0x5d8 __arm64_sys_ioctl+0x12c/0x1b8 invoke_syscall+0xd4/0x258 el0_svc_common.constprop.0+0xb4/0x240 do_el0_svc+0x48/0x68 el0_svc+0x40/0xf8 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1b0/0x1b8 The buggy address belongs to a 1-page vmalloc region starting at 0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff00000a333000 pfn:0xa333 flags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff) raw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Affected

61 ranges· showing 25
VendorProductVersion rangeFixed in
linuxlinux
linuxlinux>= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < 9738be665544281aa624842812c2fbfed6f882269738be665544281aa624842812c2fbfed6f88226
linuxlinux>= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < 240c5302eed83e34e98db18f6795ee5f40814024240c5302eed83e34e98db18f6795ee5f40814024
linuxlinux>= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < 9596759a84e1dbf2670518d85e969208960041f99596759a84e1dbf2670518d85e969208960041f9
linuxlinux>= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < 95246341945163ad9a250a87ca5bd1c1252777ae95246341945163ad9a250a87ca5bd1c1252777ae
linuxlinux>= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < 9d74d10e4e26672e139a8bcf8bf95957bf2d160f9d74d10e4e26672e139a8bcf8bf95957bf2d160f
linuxlinux>= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < 7ff87da099210856cbfe2f2f7f52ddfa57af4f0c7ff87da099210856cbfe2f2f7f52ddfa57af4f0c
linuxlinux>= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < e182fe273cdf5a8931592228196ef514ffac392be182fe273cdf5a8931592228196ef514ffac392b
linuxlinux>= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < 72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e572d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 4.16.1 < 5.10.2535.10.253
linuxlinux_kernel>= 5.11 < 5.15.2035.15.203
linuxlinux_kernel>= 5.16 < 6.1.1686.1.168
linuxlinux_kernel>= 6.13 < 6.18.216.18.21
linuxlinux_kernel>= 6.19 < 6.19.116.19.11
linuxlinux_kernel>= 6.2 < 6.6.1316.6.131
linuxlinux_kernel>= 6.7 < 6.12.806.12.80
ubuntulinux

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_ubuntu7.1HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.