CVE-2026-31748
published 2026-05-01CVE-2026-31748: In the Linux kernel, the following vulnerability has been resolved: comedi: me_daq: Fix potential overrun of firmware buffer `me2600_xilinx_download()` loads…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
3.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
comedi: me_daq: Fix potential overrun of firmware buffer
`me2600_xilinx_download()` loads the firmware that was requested by
`request_firmware()`. It is possible for it to overrun the source
buffer because it blindly trusts the file format. It reads a data
stream length from the first 4 bytes into variable `file_length` and
reads the data stream contents of length `file_length` from offset 16
onwards. Although it checks that the supplied firmware is at least 16
bytes long, it does not check that it is long enough to contain the data
stream.
Add a test to ensure that the supplied firmware is long enough to
contain the header and the data stream. On failure, log an error and
return `-EINVAL`.
Affected
53 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 85acac61096f946a78cf0c4b65f7cebe580693b6 < 2fc25a4c2e055cd42ea39a1b42c89bfef70e0319 | 2fc25a4c2e055cd42ea39a1b42c89bfef70e0319 |
| linux | linux | >= 85acac61096f946a78cf0c4b65f7cebe580693b6 < 9f39fa07259eb342908e4aa0271dee038a8ce4f8 | 9f39fa07259eb342908e4aa0271dee038a8ce4f8 |
| linux | linux | >= 85acac61096f946a78cf0c4b65f7cebe580693b6 < f3f8ec00cfb8d8e826e30b1138a56355b88e9ba8 | f3f8ec00cfb8d8e826e30b1138a56355b88e9ba8 |
| linux | linux | >= 85acac61096f946a78cf0c4b65f7cebe580693b6 < c16ac4e173a05011437a2d868f70cc415339065a | c16ac4e173a05011437a2d868f70cc415339065a |
| linux | linux | >= 85acac61096f946a78cf0c4b65f7cebe580693b6 < 1bf8761eb59e94bf7b8c17b2a1ee48f14378b172 | 1bf8761eb59e94bf7b8c17b2a1ee48f14378b172 |
| linux | linux | >= 85acac61096f946a78cf0c4b65f7cebe580693b6 < a47ae40339c1048f519df33ff8840731720f57cb | a47ae40339c1048f519df33ff8840731720f57cb |
| linux | linux | >= 85acac61096f946a78cf0c4b65f7cebe580693b6 < c8c607a77aab783f2e38cc2e0f24aa6c8f6d200b | c8c607a77aab783f2e38cc2e0f24aa6c8f6d200b |
| linux | linux | >= 85acac61096f946a78cf0c4b65f7cebe580693b6 < cc797d4821c754c701d9714b58bea947e31dbbe0 | cc797d4821c754c701d9714b58bea947e31dbbe0 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 2.6.29 < 5.10.253 | 5.10.253 |
| linux | linux_kernel | >= 5.11 < 5.15.203 | 5.15.203 |
| linux | linux_kernel | >= 5.16 < 6.1.168 | 6.1.168 |
| linux | linux_kernel | >= 6.13 < 6.18.22 | 6.18.22 |
| linux | linux_kernel | >= 6.19 < 6.19.12 | 6.19.12 |
| linux | linux_kernel | >= 6.2 < 6.6.134 | 6.6.134 |
| linux | linux_kernel | >= 6.7 < 6.12.81 | 6.12.81 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-aws-5.15 | — | — |
| ubuntu | linux-aws-fips | — | — |
| ubuntu | linux-azure | — | — |
| ubuntu | linux-azure-5.15 | — | — |
| ubuntu | linux-azure-6.8 | — | — |
| ubuntu | linux-azure-fde | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_ubuntu7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-28·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2026-07-28·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local a
Ubuntu
Linux kernel (Azure CVM) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Azure CVM) vulnerabilities
Title: Linux kernel (Azure CVM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A l
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Azure FIPS) vulnerabilities
Title: Linux kernel (Azure FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A
Ubuntu
Linux kernel (Azure CVM) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-43129 [LOW] Linux kernel (Azure CVM) vulnerabilities
Title: Linux kernel (Azure CVM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A l
Ubuntu
Linux kernel (Azure CVM) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel (Azure CVM) vulnerabilities
Title: Linux kernel (Azure CVM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cac
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local
Ubuntu
Linux kernel (AWS) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (AWS) vulnerabilities
Title: Linux kernel (AWS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local a
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A loca
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 2.0
CVE-2026-43129 [LOW] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A loca
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.1
CVE-2026-46187 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.1
CVE-2026-46187 [HIGH] Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Ubuntu
Linux kernel (GCP FIPS) vulnerabilities
vendor_ubuntu·2026-07-21·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (GCP FIPS) vulnerabilities
Title: Linux kernel (GCP FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A lo
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-21·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-07-21·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Red Hat
kernel: comedi: me_daq: Fix potential overrun of firmware buffer
vendor_redhat·2026-05-01
CVE-2026-31748 CWE-1284 kernel: comedi: me_daq: Fix potential overrun of firmware buffer
kernel: comedi: me_daq: Fix potential overrun of firmware buffer
A flaw was found in the Linux kernel's comedi: me_daq module. The `me2600_xilinx_download()` function, responsible for loading firmware, does not adequately validate the length of the provided firmware data stream. This vulnerability allows for a buffer overrun, which can lead to memory corruption within the kernel. This could potentially cause system instability or other undefined behavior.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat E
GHSA
GHSA-p8vf-hr52-wpwh: In the Linux kernel, the following vulnerability has been resolved:
comedi: me_daq: Fix potential overrun of firmware buffer
`me2600_xilinx_download
ghsa_unreviewed·2026-05-01
CVE-2026-31748 GHSA-p8vf-hr52-wpwh: In the Linux kernel, the following vulnerability has been resolved:
comedi: me_daq: Fix potential overrun of firmware buffer
`me2600_xilinx_download
In the Linux kernel, the following vulnerability has been resolved:
comedi: me_daq: Fix potential overrun of firmware buffer
`me2600_xilinx_download()` loads the firmware that was requested by
`request_firmware()`. It is possible for it to overrun the source
buffer because it blindly trusts the file format. It reads a data
stream length from the first 4 bytes into variable `file_length` and
reads the data stream contents of length `file_length` from offset 16
onwards. Although it checks that the supplied firmware is at least 16
bytes long, it does not check that it is long enough to contain the data
stream.
Add a test to ensure that the supplied firmware is long enough to
contain the header and the data stream. On failure, log an error and
return `-EINVAL`.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1bf8761eb59e94bf7b8c17b2a1ee48f14378b172https://git.kernel.org/stable/c/2fc25a4c2e055cd42ea39a1b42c89bfef70e0319https://git.kernel.org/stable/c/9f39fa07259eb342908e4aa0271dee038a8ce4f8https://git.kernel.org/stable/c/a47ae40339c1048f519df33ff8840731720f57cbhttps://git.kernel.org/stable/c/c16ac4e173a05011437a2d868f70cc415339065ahttps://git.kernel.org/stable/c/c8c607a77aab783f2e38cc2e0f24aa6c8f6d200bhttps://git.kernel.org/stable/c/cc797d4821c754c701d9714b58bea947e31dbbe0https://git.kernel.org/stable/c/f3f8ec00cfb8d8e826e30b1138a56355b88e9ba8
2026-05-01
Published