CVE-2026-31649

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix integer underflow in chain mode The jumbo_frm() chain-mode implementation unconditionally computes len = nopaged_len - bmax; where nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is BUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit() decides to invoke jumbo_frm() based on skb->len (total length including page fragments): is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc); When a packet has a small linear portion (nopaged_len <= bmax) but a large total length due to page fragm...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= 286a837217204b1ef105e3a554d0757e4fdfaac1 < 513e06735f5be575b409d195822195348b164e48, >= 286a837217204b1ef105e3a554d0757e4fdfaac1 < 275bdf762e82082f064e60a92448fa2ac43cf95b, >= 286a837217204b1ef105e3a554d0757e4fdfaac1 < a2b68a9a476b9544ff31f1fbcd5d80867a8a5e2f, >= 286a837217204b1ef105e3a554d0757e4fdfaac1 < b7b8012193fd98236d7ae05d4b553f010a77b2ef, >= 286a837217204b1ef105e3a554d0757e4fdfaac1 < 2c91b39912278d0878f9ba60ba04d2518b18a08d, >= 286a837217204b1ef105e3a554d0757e4fdfaac1 < 6fca757c20396dc2e604dcc61922264e9e3dc803, >= 286a837217204b1ef105e3a554d0757e4fdfaac1 < 10d12b9240ebf96c785f0e2e4228318cd5f3a3eb, >= 286a837217204b1ef105e3a554d0757e4fdfaac1 < 51f4e090b9f87b40c21b6daadb5c06e6c0a07b67, >= 3.2, >= V3.1.6, >= V3.1.5, >= 3.2.1 < 5.10.253, >= 5.11 < 5.15.203, >= 5.16 < 6.1.169, >= 6.2 < 6.6.135, >= 6.7 < 6.12.82, >= 6.13 < 6.18.23, >= 6.19 < 6.19.13, 3.2, 7.0

Fixed versions

5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-190