CVE-2026-31505 (GCVE-0-2026-31505)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-10-21 12:39
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() iavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the value could change in runtime, we should use num_tx_queues instead. Moreover iavf_get_ethtool_stats() uses num_active_queues while iavf_get_sset_count() and iavf_get_stat_strings() use real_num_tx_queues, which triggers out-of-bounds writes when we do "ethtool -L" and "ethtool -S" simultaneously [1]. For example when we change channels from 1 to 8, Thread 3 could be scheduled before Thread 2, and out-of-bounds writes could be triggered in Thread 3: Thread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S) iavf_set_channels() ... iavf_alloc_queues() -> num_active_queues = 8 iavf_schedule_finish_config() iavf_get_sset_count() real_num_tx_queues: 1 -> buffer for 1 queue iavf_get_ethtool_stats() num_active_queues: 8 -> out-of-bounds! iavf_finish_config() -> real_num_tx_queues = 8 Use immutable num_tx_queues in all related functions to avoid the issue. [1] BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270 Write of size 8 at addr ffffc900031c9080 by task ethtool/5800 CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x6f/0xb0 print_report+0x170/0x4f3 kasan_report+0xe1/0x180 iavf_add_one_ethtool_stat+0x200/0x270 iavf_get_ethtool_stats+0x14c/0x2e0 __dev_ethtool+0x3d0c/0x5830 dev_ethtool+0x12d/0x270 dev_ioctl+0x53c/0xe30 sock_do_ioctl+0x1a9/0x270 sock_ioctl+0x3d4/0x5e0 __x64_sys_ioctl+0x137/0x1c0 do_syscall_64+0xf3/0x690 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7da0e6e36d ... </TASK> The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88813a013de0 pfn:0x13a013 flags: 0x200000000000000(node=0|zone=2) raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
References
Impacted products
Vendor Product Version
Linux Linux Version: 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d
Version: 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d
Version: 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d
Version: 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d
Version: 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31505",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:10:20.590718Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:45:54.087Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/iavf/iavf_ethtool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d5dcca707f56c46582486d783c1eca2323189111",
              "status": "affected",
              "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d",
              "versionType": "git"
            },
            {
              "lessThan": "1f931dee5b726df1940348ec31614d64bac03aa6",
              "status": "affected",
              "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d",
              "versionType": "git"
            },
            {
              "lessThan": "bb85741d2dc2be207353a412f51b83697fcbefcf",
              "status": "affected",
              "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d",
              "versionType": "git"
            },
            {
              "lessThan": "fdf902bf86a80bf15792a1d20a67a5302498d7f1",
              "status": "affected",
              "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d",
              "versionType": "git"
            },
            {
              "lessThan": "fecacfc95f195b99c71c579a472120d0b4ed65fa",
              "status": "affected",
              "version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/iavf/iavf_ethtool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\n\niavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the\nvalue could change in runtime, we should use num_tx_queues instead.\n\nMoreover iavf_get_ethtool_stats() uses num_active_queues while\niavf_get_sset_count() and iavf_get_stat_strings() use\nreal_num_tx_queues, which triggers out-of-bounds writes when we do\n\"ethtool -L\" and \"ethtool -S\" simultaneously [1].\n\nFor example when we change channels from 1 to 8, Thread 3 could be\nscheduled before Thread 2, and out-of-bounds writes could be triggered\nin Thread 3:\n\nThread 1 (ethtool -L)       Thread 2 (work)        Thread 3 (ethtool -S)\niavf_set_channels()\n...\niavf_alloc_queues()\n-\u003e num_active_queues = 8\niavf_schedule_finish_config()\n                                                   iavf_get_sset_count()\n                                                   real_num_tx_queues: 1\n                                                   -\u003e buffer for 1 queue\n                                                   iavf_get_ethtool_stats()\n                                                   num_active_queues: 8\n                                                   -\u003e out-of-bounds!\n                            iavf_finish_config()\n                            -\u003e real_num_tx_queues = 8\n\nUse immutable num_tx_queues in all related functions to avoid the issue.\n\n[1]\n BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270\n Write of size 8 at addr ffffc900031c9080 by task ethtool/5800\n\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x6f/0xb0\n  print_report+0x170/0x4f3\n  kasan_report+0xe1/0x180\n  iavf_add_one_ethtool_stat+0x200/0x270\n  iavf_get_ethtool_stats+0x14c/0x2e0\n  __dev_ethtool+0x3d0c/0x5830\n  dev_ethtool+0x12d/0x270\n  dev_ioctl+0x53c/0xe30\n  sock_do_ioctl+0x1a9/0x270\n  sock_ioctl+0x3d4/0x5e0\n  __x64_sys_ioctl+0x137/0x1c0\n  do_syscall_64+0xf3/0x690\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f7da0e6e36d\n ...\n  \u003c/TASK\u003e\n\n The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830\n The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff88813a013de0 pfn:0x13a013\n flags: 0x200000000000000(node=0|zone=2)\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n  ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n \u003effffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n                    ^\n  ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n  ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached locally through `ioctl(SIOCETHTOOL)` on a socket, specifically `ETHTOOL_GSTATS` calling the iavf ethtool statistics callback. Remote packets may influence counter values but do not directly invoke the vulnerable code.\nAC:L - The bug is a race between attacker-issued channel reconfiguration and stats retrieval; the attacker can repeatedly run `ethtool -L` and `ethtool -S` to hit the window before `finish_config` updates `real_num_tx_queues`. No rare external condition is required.\nPR:L - `ETHTOOL_GSTATS` is allowed to any local user, but reliably creating the mismatched queue-count state requires `ETHTOOL_SCHANNELS`, gated by `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`. In plausible delegated VF/container netns deployments this is a low namespace privilege rather than real init-namespace root.\nUI:N - No victim action is required when the attacker has the needed local namespace capability; the attacker can issue both ethtool operations directly. The vulnerable stats read itself is synchronous from the attacker\u2019s ioctl.\nS:U - The corruption occurs inside the same kernel security authority as the vulnerable network driver. This is standard kernel memory corruption/privilege escalation, not a VM escape or IOMMU boundary bypass.\nC:H - The flaw is an out-of-bounds kernel write in a vmalloc-backed stats buffer, which is memory corruption that can plausibly be leveraged during exploitation for information disclosure. Under the required conservative rule, this is High.\nI:H - The vulnerable function writes attacker-influenced u64 statistics past the allocated buffer when queue counts diverge. Out-of-bounds kernel writes are treated as high integrity impact because they can corrupt kernel memory and potentially enable code execution.\nA:H - The reported failure is a KASAN vmalloc-out-of-bounds write in kernel context, and the same corruption can oops or panic the kernel. The trigger can be repeated by local ethtool calls."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:39:21.302Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d5dcca707f56c46582486d783c1eca2323189111"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f931dee5b726df1940348ec31614d64bac03aa6"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb85741d2dc2be207353a412f51b83697fcbefcf"
        },
        {
          "url": "https://git.kernel.org/stable/c/fdf902bf86a80bf15792a1d20a67a5302498d7f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/fecacfc95f195b99c71c579a472120d0b4ed65fa"
        }
      ],
      "title": "iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31505",
    "datePublished": "2026-04-22T13:54:24.524Z",
    "dateReserved": "2026-03-09T15:48:24.105Z",
    "dateUpdated": "2026-10-21T12:39:21.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-31505\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T15:10:20.590718Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T15:10:21.189Z\"}}], \"cna\": {\"title\": \"iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is reached locally through `ioctl(SIOCETHTOOL)` on a socket, specifically `ETHTOOL_GSTATS` calling the iavf ethtool statistics callback. Remote packets may influence counter values but do not directly invoke the vulnerable code.\\nAC:L - The bug is a race between attacker-issued channel reconfiguration and stats retrieval; the attacker can repeatedly run `ethtool -L` and `ethtool -S` to hit the window before `finish_config` updates `real_num_tx_queues`. No rare external condition is required.\\nPR:L - `ETHTOOL_GSTATS` is allowed to any local user, but reliably creating the mismatched queue-count state requires `ETHTOOL_SCHANNELS`, gated by `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`. In plausible delegated VF/container netns deployments this is a low namespace privilege rather than real init-namespace root.\\nUI:N - No victim action is required when the attacker has the needed local namespace capability; the attacker can issue both ethtool operations directly. The vulnerable stats read itself is synchronous from the attacker\\u2019s ioctl.\\nS:U - The corruption occurs inside the same kernel security authority as the vulnerable network driver. This is standard kernel memory corruption/privilege escalation, not a VM escape or IOMMU boundary bypass.\\nC:H - The flaw is an out-of-bounds kernel write in a vmalloc-backed stats buffer, which is memory corruption that can plausibly be leveraged during exploitation for information disclosure. Under the required conservative rule, this is High.\\nI:H - The vulnerable function writes attacker-influenced u64 statistics past the allocated buffer when queue counts diverge. Out-of-bounds kernel writes are treated as high integrity impact because they can corrupt kernel memory and potentially enable code execution.\\nA:H - The reported failure is a KASAN vmalloc-out-of-bounds write in kernel context, and the same corruption can oops or panic the kernel. The trigger can be repeated by local ethtool calls.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d\", \"lessThan\": \"d5dcca707f56c46582486d783c1eca2323189111\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d\", \"lessThan\": \"1f931dee5b726df1940348ec31614d64bac03aa6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d\", \"lessThan\": \"bb85741d2dc2be207353a412f51b83697fcbefcf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d\", \"lessThan\": \"fdf902bf86a80bf15792a1d20a67a5302498d7f1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d\", \"lessThan\": \"fecacfc95f195b99c71c579a472120d0b4ed65fa\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/intel/iavf/iavf_ethtool.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.160\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.80\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.21\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.19.*\"}, {\"status\": \"unaffected\", \"version\": \"7.0\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/intel/iavf/iavf_ethtool.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d5dcca707f56c46582486d783c1eca2323189111\"}, {\"url\": \"https://git.kernel.org/stable/c/1f931dee5b726df1940348ec31614d64bac03aa6\"}, {\"url\": \"https://git.kernel.org/stable/c/bb85741d2dc2be207353a412f51b83697fcbefcf\"}, {\"url\": \"https://git.kernel.org/stable/c/fdf902bf86a80bf15792a1d20a67a5302498d7f1\"}, {\"url\": \"https://git.kernel.org/stable/c/fecacfc95f195b99c71c579a472120d0b4ed65fa\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\\n\\niavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the\\nvalue could change in runtime, we should use num_tx_queues instead.\\n\\nMoreover iavf_get_ethtool_stats() uses num_active_queues while\\niavf_get_sset_count() and iavf_get_stat_strings() use\\nreal_num_tx_queues, which triggers out-of-bounds writes when we do\\n\\\"ethtool -L\\\" and \\\"ethtool -S\\\" simultaneously [1].\\n\\nFor example when we change channels from 1 to 8, Thread 3 could be\\nscheduled before Thread 2, and out-of-bounds writes could be triggered\\nin Thread 3:\\n\\nThread 1 (ethtool -L)       Thread 2 (work)        Thread 3 (ethtool -S)\\niavf_set_channels()\\n...\\niavf_alloc_queues()\\n-\u003e num_active_queues = 8\\niavf_schedule_finish_config()\\n                                                   iavf_get_sset_count()\\n                                                   real_num_tx_queues: 1\\n                                                   -\u003e buffer for 1 queue\\n                                                   iavf_get_ethtool_stats()\\n                                                   num_active_queues: 8\\n                                                   -\u003e out-of-bounds!\\n                            iavf_finish_config()\\n                            -\u003e real_num_tx_queues = 8\\n\\nUse immutable num_tx_queues in all related functions to avoid the issue.\\n\\n[1]\\n BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270\\n Write of size 8 at addr ffffc900031c9080 by task ethtool/5800\\n\\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n Call Trace:\\n  \u003cTASK\u003e\\n  dump_stack_lvl+0x6f/0xb0\\n  print_report+0x170/0x4f3\\n  kasan_report+0xe1/0x180\\n  iavf_add_one_ethtool_stat+0x200/0x270\\n  iavf_get_ethtool_stats+0x14c/0x2e0\\n  __dev_ethtool+0x3d0c/0x5830\\n  dev_ethtool+0x12d/0x270\\n  dev_ioctl+0x53c/0xe30\\n  sock_do_ioctl+0x1a9/0x270\\n  sock_ioctl+0x3d4/0x5e0\\n  __x64_sys_ioctl+0x137/0x1c0\\n  do_syscall_64+0xf3/0x690\\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n RIP: 0033:0x7f7da0e6e36d\\n ...\\n  \u003c/TASK\u003e\\n\\n The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830\\n The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000\\n index:0xffff88813a013de0 pfn:0x13a013\\n flags: 0x200000000000000(node=0|zone=2)\\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\\n page dumped because: kasan: bad access detected\\n\\n Memory state around the buggy address:\\n  ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\\n  ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n \u003effffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\\n                    ^\\n  ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\\n  ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.160\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.80\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.21\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19.11\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.0\", \"versionStartIncluding\": \"5.17\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-10-21T12:39:21.302Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-31505\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-21T12:39:21.302Z\", \"dateReserved\": \"2026-03-09T15:48:24.105Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-04-22T13:54:24.524Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.