CVE-2026-31505
type: TechArticle
description: In the Linux kernel, the following vulnerability has been resolved: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() iavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the value could change in runtime, we should use num_tx_queues instead. Moreover iavf_get_ethtool_stats() uses num_active_queues while iavf_get_sset_count() and iavf_get_stat_strings() use real_num_tx_queues, which triggers out-of-bounds writes when we do "ethtool -L" and "ethtool -S" simultaneously [1]. For example when we change channels from 1 to 8, Thread 3 could be scheduled before Thread 2, and out-of-bounds writes could be triggered in Thread 3: Thread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S) iavf_set_channels() ... iavf_alloc_queues() -> num_active_queues = 8 iavf_schedule_finish_config() iavf_get_sset_count() real_num_tx_queues: 1
date published: 2026-04-22T14:16:49.233
license: https://creativecommons.org/publicdomain/zero/1.0/
source: https://nvd.nist.gov/vuln/detail/CVE-2026-31505
publisher: AI Analytics
source organization: NIST National Vulnerability Database
main entity: Thing
  additional type: Vulnerability
  score: 7.8
  severity: HIGH
keywords: CWE-787

AI Analytics
type: Organization