# CVE-2026-31505: CVE-2026-31505

Status: published. Published: 2026-04-22. Updated: 2026-11-11.

In the Linux kernel, the following vulnerability has been resolved:

iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()

iavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the
value could change in runtime, we should use num_tx_queues instead.

Moreover iavf_get_ethtool_stats() uses num_active_queues while
iavf_get_sset_count() and iavf_get_stat_strings() use
real_num_tx_queues, which triggers out-of-bounds writes when we do
"ethtool -L" and "ethtool -S" simultaneously [1].

For example when we change channels from 1 to 8, Thread 3 could be
scheduled before Thread 2, and out-of-bounds writes could be triggered
in Thread 3:

Thread 1 (ethtool -L)       Thread 2 (work)        Thread 3 (ethtool -S)
iavf_set_channels()
...
iavf_alloc_queues()
-> num_active_queues = 8
iavf_schedule_finish_config()
                                                   iavf_get_sset_count()
                                                   real_num_tx_queues: 1
                                                   -> buffer for 1 queue
                                                   iavf_get_ethtool_stats()
                                                   num_active_queues: 8
                                                   -> out-of-bounds!
                            iavf_finish_config()
                            -> real_num_tx_queues = 8

Use immutable num_tx_queues in all related functions to avoid the issue.

[1]
 BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270
 Write of size 8 at addr ffffc900031c9080 by task ethtool/5800

 CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
 Call Trace:
  <TASK>
  dump_stack_lvl+0x6f/0xb0
  print_report+0x170/0x4f3
  kasan_report+0xe1/0x180
  iavf_add_one_ethtool_stat+0x200/0x270
  iavf_get_ethtool_stats+0x14c/0x2e0
  __dev_ethtool+0x3d0c/0x5830
  dev_ethtool+0x12d/0x270
  dev_ioctl+0x53c/0xe30
  sock_do_ioctl+0x1a9/0x270
  sock_ioctl+0x3d4/0x5e0
  __x64_sys_ioctl+0x137/0x1c0
  do_syscall_64+0xf3/0x690
  entry_SYSCALL_64_after_hwframe+0x77/0x7f
 RIP: 0033:0x7f7da0e6e36d
 ...
  </TASK>

 The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830
 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000
 index:0xffff88813a013de0 pfn:0x13a013
 flags: 0x200000000000000(node=0|zone=2)
 raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000
 raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000
 page dumped because: kasan: bad access detected

 Memory state around the buggy address:
  ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 >ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                    ^
  ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/1f931dee5b726df1940348ec31614d64bac03aa6
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/bb85741d2dc2be207353a412f51b83697fcbefcf
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/fdf902bf86a80bf15792a1d20a67a5302498d7f1
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/fecacfc95f195b99c71c579a472120d0b4ed65fa

## Affected products and versions

- linux / linux_kernel: ≥ 5.17.1; < 6.12.80 (affected, custom). Source: NVD
- linux / linux_kernel: ≥ 6.13; < 6.18.21 (affected, custom). Source: NVD
- linux / linux_kernel: ≥ 6.19; < 6.19.11 (affected, custom). Source: NVD
- linux / linux_kernel: 5.17 (affected, custom). Source: NVD
- linux / linux_kernel: 7.0 (affected, custom). Source: NVD

## NVD configuration conditions

Affected CPE matches depend on the following AND/OR and negation conditions:

```json
[
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.12.80",
            "versionStartIncluding": "5.17.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.18.21",
            "versionStartIncluding": "6.13",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.19.11",
            "versionStartIncluding": "6.19",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  }
]
```

## Severity and prioritization

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; source: NVD: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable no; technical impact total; source NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0

- Weaknesses: CWE-787

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/1f931dee5b726df1940348ec31614d64bac03aa6 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/20a31b84b3e3af21bbb2628fdad185b1f274a5f5 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/bb85741d2dc2be207353a412f51b83697fcbefcf (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/d5dcca707f56c46582486d783c1eca2323189111 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/fdf902bf86a80bf15792a1d20a67a5302498d7f1 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/fecacfc95f195b99c71c579a472120d0b4ed65fa (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-31505; retrieved 2026-11-12; source updated 2026-11-11

Revision: 43a3c2a856c8428d86b5fb5561e21300c328c455d9174ae7fc6e876cc7e83c90

Canonical: https://y2.dev/cve/CVE-2026-31505

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.