CVE-2026-31494

Home/CVE/In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats

CVE

In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats

In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats There's a potential mismatch between the memory reserved for statistics and the amount of memory written. gem_get_sset_count() correctly computes the number of stats based on the active queues, whereas gem_get_ethtool_stats() indiscriminately copies data using the maximum number of queues, and in the case the number of active queues is less than MACB_MAX_QUEUES, this results in a OOB write as observed in the KASAN splat. ================================================================== BUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78 [macb] Write of size 760 at addr ffff80008080b000 by task ethtool/1027 CPU: [...] Tainted: [E]=UNSIGNED_MODULE Hardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025 Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x80/0xf8 print_report+0x384/0x5e0 kasan_report+0xa0/0xf0 kasan_check_range+0xe8/0x190 __asan_memcpy+0x54/0x98 gem_get_ethtool_stats+0x54/0x78 [macb 926c13f3af83b0c6fe64badb21ec87d5e93fcf65] dev_ethtool+0x1220/0x38c0 dev_ioctl+0x4ac/0xca8 sock_do_ioctl+0x170/0x1d8 sock_ioctl+0x484/0x5d8 __arm64_sys_ioctl+0x12c/0x1b8 invoke_syscall+0xd4/0x258 el0_svc_common.constprop.0+0xb4/0x240 do_el0_svc+0x48/0x68 el0_svc+0x40/0xf8 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1b0/0x1b8 The buggy address belongs to a 1-page vmalloc region starting at 0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0 The buggy address belongs to the physical page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff00000a333000 pfn:0xa333 flags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff) raw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff80008080b080: 00 ffff80008080b100: 00 >ffff80008080b180: 00 f8 ^ ffff80008080b200: f8 ffff80008080b280: f8 ================================================================== Fix it by making sure the copied size only considers the active number of queues.

HIGH · CVSS 7.8 EPSS 0.00022

Schedule remediation

CVSS base score ≥ 7.0

Sigma rules0 YARA rules0

Look this up elsewhere - one-click external pivots

NVD CVE.org CISA Vulners Exploit-DB GitHub PoC VulnCheck KEV GreyNoise

▸ How to read a CVE - triage first, then detect and patch

This page is every public fact about CVE-2026-31494, cross-linked. Its job is to answer one question fast - does this need my attention now? - and then hand you the two things you do about it. Here is how an analyst reads it.

Triage: should I act now? Four signals, and they are not interchangeable:

CVSSseverity - how bad it is IF exploited, 0-10. A high CVSS alone is not urgency; a flaw can be a perfect 10 and never actually be attacked. EPSSprobability - a model’s estimate of the chance it is exploited in the next 30 days, 0-1. This is the “will it actually happen” signal. CISA KEVconfirmed - it is being exploited in the wild right now. The strongest signal on the page; KEV beats any score. Weaponisedavailability - public exploits / PoCs, and especially Metasploit modules rated Excellent / Great. Reliable, packaged exploit code means low-skill attackers can use it today.

How they combine: KEV, or a dependable Metasploit module, means patch now regardless of CVSS. High CVSS + low EPSS + no exploit is real but not an emergency - schedule it. Low CVSS but KEV-listed still gets patched now. The verdict above already weighed these for you; this is how it got there.

Then what - two workflows:

Detectwhen you cannot patch today, follow this CVE to the ATT&CK techniques it enables, then Build a SIEM detection (the green button) - author a rule, test it in Atomic, deploy it. That buys visibility while the patch waits. PatchAffected products / packages tell you if you are exposed; Fixed versions by distribution and Vendor advisories give the exact version that closes it.

Reading order for the panels below: verdict + badges, then Public exploits / Metasploit (is it weaponised), then ATT&CK techniques + Sigma / IDS rules (can I detect it), then Affected products / packages + Fixed versions (am I exposed, what patches it), then Threat actors / IOCs (who uses it), then Scoring & timeline / references (the evidence).

View attack path from CVE-2026-31494

◆

ATT&CK techniques

Techniques this CVE enables - linked via CWECAPECATT&CK. High◆ = named directly in ATT&CK or Nuclei templates.

T1068 · Exploitation for Privilege Escalation

▤ Build a SIEM detection for these techniques

⬡

Weakness Classification

CWE-787Out-of-bounds Write

▤

Affected Products & Versions

linux kernel>= 4.16.1 and < 5.10.253
linux kernel>= 5.11 and < 5.15.203
linux kernel>= 5.16 and < 6.1.168
linux kernel>= 6.2 and < 6.6.131
linux kernel>= 6.7 and < 6.12.80
linux kernel>= 6.13 and < 6.18.21
linux kernel>= 6.19 and < 6.19.11
linux kernelall versions

📦

Fixed versions by distribution

The package version that resolves this CVE on each Linux distribution, from the vendor’s published security data. fixed in shows a patched version exists; open means the package is listed as affected with no fix yet.
suse sle15cluster-md-kmp-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15dlm-kmp-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15gfs2-kmp-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15kernel-64kb fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-azure fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-default fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-default-base fixed in 0:6.4.0-150700.53.55.1.150700.17.33.1
suse sle15kernel-default-devel open
suse sle15kernel-default-extra fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-default-man open
suse sle15kernel-devel open
suse sle15kernel-docs fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-livepatch-6_4_0-150700_7_54-rt fixed in 0:1-150700.1.3.1
suse sle15kernel-macros open
suse sle15kernel-obs-build fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15kernel-source fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-source-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15kernel-syms fixed in 0:6.4.0-150700.53.55.1
suse sle15kernel-syms-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15kernel-zfcpdump fixed in 0:6.4.0-150700.53.55.1
suse sle15ocfs2-kmp-rt fixed in 0:6.4.0-150700.7.54.1
suse sle15reiserfs-kmp-default fixed in 0:6.4.0-150700.53.55.1

▣

Scoring & Timeline

7.8

HIGH · CVSS v3.1 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67

View on NVD

Attack Vector

Network Adjacent Local Physical

Attack Complexity

Low High

Privileges Required

None Low High

User Interaction

None Required

Scope

Unchanged Changed

Confidentiality

None Low High

Integrity

None Low High

Availability

None Low High

Published to NVD22 Apr 2026 · 02:16 PM

CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

⚑

Vendor Advisories

suse-csafSUSE-SU-2026:2238-1
suse-csafSUSE-SU-2026:2217-1
suse-csafSUSE-SU-2026:21876-1
suse-csafSUSE-SU-2026:21877-1
suse-csafSUSE-SU-2026:21916-1
Show all 11 vendor advisoriessuse-csafSUSE-SU-2026:21919-1
suse-csafopenSUSE-SU-2026:20826-1
suse-csafSUSE-SU-2026:21841-1
suse-csafSUSE-SU-2026:21845-1
suse-csafSUSE-SU-2026:21860-1
msrcCVE-2026-31494

🔗

References & Sources

Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.

https://git.kernel.org/stable/c/240c5302eed83e34e98db18f6795ee5f40814024Patch

https://git.kernel.org/stable/c/72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5Patch

https://git.kernel.org/stable/c/7ff87da099210856cbfe2f2f7f52ddfa57af4f0cPatch

https://git.kernel.org/stable/c/95246341945163ad9a250a87ca5bd1c1252777aePatch

https://git.kernel.org/stable/c/9596759a84e1dbf2670518d85e969208960041f9Patch

https://git.kernel.org/stable/c/9738be665544281aa624842812c2fbfed6f88226Patch

Show all 8 references

https://git.kernel.org/stable/c/9d74d10e4e26672e139a8bcf8bf95957bf2d160fPatch

https://git.kernel.org/stable/c/e182fe273cdf5a8931592228196ef514ffac392bPatch