# CVE-2026-31484

> Vulnerability · severity: **HIGH** (CVSS 7.1).

## Description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check

__io_uring_show_fdinfo() iterates over pending SQEs and, for 128-byte
SQEs on an IORING_SETUP_SQE_MIXED ring, needs to detect when the second
half of the SQE would be past the end of the sq_sqes array. The current
check tests (++sq_head & sq_mask) == 0, but sq_head is only incremented
when a 128-byte SQE is encountered, not on every iteration. The actual
array index is sq_idx = (i + sq_head) & sq_mask, which can be sq_mask
(the last slot) while the wrap check passes.

Fix by checking sq_idx directly. Keep the sq_head increment so the loop
still skips the second half of the 128-byte SQE on the next iteration.

## Key facts

- **CVE ID:** CVE-2026-31484
- **Published:** 2026-04-22
- **CVSS severity:** HIGH
- **CVSS base score:** 7.1
- **CWE codes:** CWE-125

## Affected products

- `linux:linux_kernel`

## Primary sources

- NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-31484

## Citation

> AI Analytics. CVE-2026-31484. Retrieved 2026-07-23 from https://api.ai-analytics.org/cve/CVE-2026-31484. Derived from NIST NVD. Licensed CC0.

---

*[Dataset catalog](https://api.ai-analytics.org/datasets/) · [AI Analytics](https://api.ai-analytics.org/) · CC0 1.0*