{"id":"CVE-2026-31786","title":"Buffer overflow in drivers/xen/sys-hypervisor.c","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBuffer overflow in drivers/xen/sys-hypervisor.c\n\nThe build id returned by HYPERVISOR_xen_version(XENVER_build_id) is\nneither NUL terminated nor a string.\n\nThe first cau…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < e3af585e1728c917682b6a3de9a69b41fb9194d4","Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < 8288d031a01dbacfde3fc643f7be3d23504de64d","Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < f458ba102da97fafca106327086fc95f3fc764cb","Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < 4b4defd2fce3f966c25adabf46644a85558f1169","Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < 5c5ff7c7bd15bb536f44b10b3fb5b8408f344d0a","Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < d5f59216650c51e5e3fcb7517c825bc8047f60ef","Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < 52cecff98bda2c51eed1c6ce9d21c5d6268fb19d","Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < 27fdbab4221b375de54bf91919798d88520c6e28","Linux 4.13"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:13:16.479800Z"},"published":"2026-04-30","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:27.177Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31786","references":[{"url":"https://git.kernel.org/stable/c/e3af585e1728c917682b6a3de9a69b41fb9194d4"},{"url":"https://git.kernel.org/stable/c/8288d031a01dbacfde3fc643f7be3d23504de64d"},{"url":"https://git.kernel.org/stable/c/f458ba102da97fafca106327086fc95f3fc764cb"},{"url":"https://git.kernel.org/stable/c/4b4defd2fce3f966c25adabf46644a85558f1169"},{"url":"https://git.kernel.org/stable/c/5c5ff7c7bd15bb536f44b10b3fb5b8408f344d0a"},{"url":"https://git.kernel.org/stable/c/d5f59216650c51e5e3fcb7517c825bc8047f60ef"},{"url":"https://git.kernel.org/stable/c/52cecff98bda2c51eed1c6ce9d21c5d6268fb19d"},{"url":"https://git.kernel.org/stable/c/27fdbab4221b375de54bf91919798d88520c6e28"}],"tags":["cve.org"],"epss":0.00209,"epssPercentile":0.10392,"ingestedAt":"2026-10-16T17:24:46.675Z","slug":"CVE-2026-31786","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBuffer overflow in drivers/xen/sys-hypervisor.c\n\nThe build id returned by HYPERVISOR_xen_version(XENVER_build_id) is\nneither NUL terminated nor a string.\n\nThe first causes a buffer overflow as sprintf in buildid_show will\nread and copy till it finds a NUL.\n\n00000000  f4 91 51 f4 dd 38 9e 9d  65 47 52 eb 10 71 db 50  |..Q..8..eGR..q.P|\n00000010  b9 a8 01 42 6f 2e 32                              |...Bo.2|\n00000017\n\nSo use a memcpy instead of sprintf to have the correct value:\n\n00000000  f4 91 51 f4 dd 00 9e 9d  65 47 52 eb 10 71 db 50  |..Q.....eGR..q.P|\n00000010  b9 a8 01 42                                       |...B|\n00000014\n\n(the above have a hack to embed a zero inside and check it's\nreturned correctly).\n\nThis is XSA-485 / CVE-2026-31786\n\n## Affected\n\n- `Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < e3af585e1728c917682b6a3de9a69b41fb9194d4`\n- `Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < 8288d031a01dbacfde3fc643f7be3d23504de64d`\n- `Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < f458ba102da97fafca106327086fc95f3fc764cb`\n- `Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < 4b4defd2fce3f966c25adabf46644a85558f1169`\n- `Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < 5c5ff7c7bd15bb536f44b10b3fb5b8408f344d0a`\n- `Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < d5f59216650c51e5e3fcb7517c825bc8047f60ef`\n- `Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < 52cecff98bda2c51eed1c6ce9d21c5d6268fb19d`\n- `Linux >= 84b7625728ea311ea35bdaa0eded53c1c56baeaa < 27fdbab4221b375de54bf91919798d88520c6e28`\n- `Linux 4.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}