CVE-2026-31494

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats There's a potential mismatch between the memory reserved for statistics and the amount of memory written. gem_get_sset_count() correctly computes the number of stats based on the active queues, whereas gem_get_ethtool_stats() indiscriminately copies data using the maximum number of queues, and in the case the number of active queues is less than MACB_MAX_QUEUES, this results in a OOB write as observed in the KASAN splat. ======================================================...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < 9738be665544281aa624842812c2fbfed6f88226, >= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < 240c5302eed83e34e98db18f6795ee5f40814024, >= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < 9596759a84e1dbf2670518d85e969208960041f9, >= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < 95246341945163ad9a250a87ca5bd1c1252777ae, >= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < 9d74d10e4e26672e139a8bcf8bf95957bf2d160f, >= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < 7ff87da099210856cbfe2f2f7f52ddfa57af4f0c, >= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < e182fe273cdf5a8931592228196ef514ffac392b, >= 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd < 72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5, >= 4.16, >= V3.1.6, >= V3.1.5, >= 4.16.1 < 5.10.253, >= 5.11 < 5.15.203, >= 5.16 < 6.1.168, >= 6.2 < 6.6.131, >= 6.7 < 6.12.80, >= 6.13 < 6.18.21, >= 6.19 < 6.19.11, 4.16, 7.0

Fixed versions

5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-787