Security readout for executives and security teams
Plain-English summary
A local user may trigger a timing flaw in Linux systems using the Cadence MACB/GEM network driver. Closing an interface can free its precision-time clock while another request still accesses it, potentially crashing the system or corrupting kernel memory. The supplied CVSS score is 7.8, but exposure depends on the driver and vulnerable kernel code being present.
Executive priority
Treat this as a high-priority patching item where MACB/GEM-equipped Linux systems permit untrusted local access or support important operations. It is not evidence of an internet-wide emergency: no active exploitation is documented, and systems without the relevant driver or vulnerable code are unlikely to be exposed. Require inventory confirmation and vendor-backed remediation.
Technical view
CVE-2026-31396 is a use-after-free involving the MACB/GEM driver's PTP clock. The clock was registered when the interface opened and destroyed when it closed, while an ethtool timestamp-information request could access it whenever the interface remained registered. A concurrent close and query can therefore dereference freed kernel memory. Linux stable commits are supplied as fixes.
Likely exposure
Likely exposure is limited to Linux hosts or embedded devices using the Cadence MACB/GEM Ethernet driver with affected kernel code. The CVSS vector requires local access and low privileges. The supplied version data is ambiguous, so determine exposure from the running kernel, enabled driver, hardware, and vendor backport status rather than version numbers alone.
Exploitation context
The supplied record is not in CISA KEV and provides no evidence of active exploitation or a public exploit. The reported crash was detected with KASAN during syzkaller-style testing. Exploitation reliability and practical impact beyond the demonstrated use-after-free are not established by the provided sources.
Researcher notes
The demonstrated path reaches ptp_clock_index through gem_get_ts_info and macb_get_ts_info after concurrent PTP clock removal during interface close. KASAN confirms a four-byte read from freed memory. The CVSS vector claims confidentiality, integrity, and availability impact, but the bundle demonstrates only the memory-safety violation; exploitability beyond a crash remains unproven.
Mitigation direction
- Install a vendor-supported kernel containing the applicable Linux stable fix.
- Check distribution and device-vendor advisories for backported remediation status.
- Prioritize exposed multi-user, appliance, and industrial systems using MACB/GEM networking.
- If patching is delayed, follow vendor guidance and limit untrusted local access.
Validation and detection
- Record the running kernel build and distribution or device-vendor patch level.
- Confirm whether the Cadence MACB/GEM driver is present, enabled, and bound to hardware.
- Verify the kernel package includes an applicable referenced stable commit or documented backport.
- Review kernel logs for KASAN reports, use-after-free faults, or crashes involving macb, gem, or PTP.
- Assess which local users or workloads can issue network timestamp-information requests.
Public sources used
- CVE Program record for CVE-2026-31396
- CVE List V5 record
- Linux stable fix 8820ffe0975f
- Linux stable fix 6b757f345eee
- Linux stable fix 341d01087f82
- Linux stable fix 5653af416a48
- Linux stable fix 0bb848d8c649
- Linux stable fix 1f4714065b2b
- Linux stable fix eb652535e9ec
- Linux stable fix 8da13e6d63c1
- Siemens ProductCERT advisory SSA-082556
- Siemens ProductCERT advisory SSA-019113
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31396 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8820ffe0975fd2efbe50453e9179c8e1c33a13d3CVE reference, Linux
- https://git.kernel.org/stable/c/6b757f345eeea87ed5d8afd6de35b927a1a57a2fCVE reference, Linux
- https://git.kernel.org/stable/c/341d01087f821aa0f165fb1ffc8bfe4e50776da7CVE reference, Linux
- https://git.kernel.org/stable/c/5653af416a48f6c18f9626ae9df96f814f45ff34CVE reference, Linux
- https://git.kernel.org/stable/c/0bb848d8c64938024e45780f8032f1f67d3a3607CVE reference, Linux
- https://git.kernel.org/stable/c/1f4714065b2bcbb0a4013fd355b84b848e6cc345CVE reference, Linux
- https://git.kernel.org/stable/c/eb652535e9ec795ef5c1078f7578eaaed755268bCVE reference, Linux
- https://git.kernel.org/stable/c/8da13e6d63c1a97f7302d342c89c4a56a55c7015CVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.