{"id":"CVE-2026-31505","title":"iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\n\niavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the\nvalue could change in runtime, we shoul…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d < 1f931dee5b726df1940348ec31614d64bac03aa6","Linux >= 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d < bb85741d2dc2be207353a412f51b83697fcbefcf","Linux >= 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d < fdf902bf86a80bf15792a1d20a67a5302498d7f1","Linux >= 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d < fecacfc95f195b99c71c579a472120d0b4ed65fa","Linux 5.17"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:10:20.590718Z"},"published":"2026-04-22","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:13.643Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31505","references":[{"url":"https://git.kernel.org/stable/c/1f931dee5b726df1940348ec31614d64bac03aa6"},{"url":"https://git.kernel.org/stable/c/bb85741d2dc2be207353a412f51b83697fcbefcf"},{"url":"https://git.kernel.org/stable/c/fdf902bf86a80bf15792a1d20a67a5302498d7f1"},{"url":"https://git.kernel.org/stable/c/fecacfc95f195b99c71c579a472120d0b4ed65fa"}],"tags":["cve.org"],"epss":0.00175,"epssPercentile":0.0654,"ingestedAt":"2026-10-16T17:24:46.658Z","slug":"CVE-2026-31505","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\n\niavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the\nvalue could change in runtime, we should use num_tx_queues instead.\n\nMoreover iavf_get_ethtool_stats() uses num_active_queues while\niavf_get_sset_count() and iavf_get_stat_strings() use\nreal_num_tx_queues, which triggers out-of-bounds writes when we do\n\"ethtool -L\" and \"ethtool -S\" simultaneously [1].\n\nFor example when we change channels from 1 to 8, Thread 3 could be\nscheduled before Thread 2, and out-of-bounds writes could be triggered\nin Thread 3:\n\nThread 1 (ethtool -L)       Thread 2 (work)        Thread 3 (ethtool -S)\niavf_set_channels()\n...\niavf_alloc_queues()\n-> num_active_queues = 8\niavf_schedule_finish_config()\n                                                   iavf_get_sset_count()\n                                                   real_num_tx_queues: 1\n                                                   -> buffer for 1 queue\n                                                   iavf_get_ethtool_stats()\n                                                   num_active_queues: 8\n                                                   -> out-of-bounds!\n                            iavf_finish_config()\n                            -> real_num_tx_queues = 8\n\nUse immutable num_tx_queues in all related functions to avoid the issue.\n\n[1]\n BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270\n Write of size 8 at addr ffffc900031c9080 by task ethtool/5800\n\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n  <TASK>\n  dump_stack_lvl+0x6f/0xb0\n  print_report+0x170/0x4f3\n  kasan_report+0xe1/0x180\n  iavf_add_one_ethtool_stat+0x200/0x270\n  iavf_get_ethtool_stats+0x14c/0x2e0\n  __dev_ethtool+0x3d0c/0x5830\n  dev_ethtool+0x12d/0x270\n  dev_ioctl+0x53c/0xe30\n  sock_do_ioctl+0x1a9/0x270\n  sock_ioctl+0x3d4/0x5e0\n  __x64_sys_ioctl+0x137/0x1c0\n  do_syscall_64+0xf3/0x690\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f7da0e6e36d\n ...\n  </TASK>\n\n The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830\n The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff88813a013de0 pfn:0x13a013\n flags: 0x200000000000000(node=0|zone=2)\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n  ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n >ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n                    ^\n  ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n  ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n\n## Affected\n\n- `Linux >= 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d < 1f931dee5b726df1940348ec31614d64bac03aa6`\n- `Linux >= 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d < bb85741d2dc2be207353a412f51b83697fcbefcf`\n- `Linux >= 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d < fdf902bf86a80bf15792a1d20a67a5302498d7f1`\n- `Linux >= 64430f70ba6fcd5872ac190f4ae3ddee3f48f00d < fecacfc95f195b99c71c579a472120d0b4ed65fa`\n- `Linux 5.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}