CVE-2026-31484: io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check
In the Linux kernel, the following vulnerability has been resolved:
io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check
__io_uring_show_fdinfo() iterates over pending SQEs and, for 128-byte
SQEs on an IORING_SETUP_SQE_MIXED ring, needs to detect when the second
half of the SQE would be past the end of the sq_sqes array. The current
check tests (++sq_head & sq_mask) == 0, but sq_head is only incremented
when a 128-byte SQE is encountered, not on every iteration. The actual
array index is sq_idx = (i + sq_head) & sq_mask, which can be sq_mask
(the last slot) while the wrap check passes.
Fix by checking sq_idx directly. Keep the sq_head increment so the loop
still skips the second half of the 128-byte SQE on the next iteration.
Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw can read beyond an internal io_uring buffer when process information is inspected. A local, low-privileged user may be able to expose sensitive kernel data or disrupt the system. No remote attack path is identified.
Executive priority
Treat as a high-priority operating-system update, especially on shared compute, hosting, developer, and container-worker systems. It is less urgent than an internet-exploitable issue, but local data disclosure and system disruption could amplify an existing foothold.
Technical view
The io_uring fdinfo handler calculates the wrong wrap condition while iterating mixed-size submission entries. For a 128-byte entry in an IORING_SETUP_SQE_MIXED ring, it may access beyond the sq_sqes array. The published CVSS 3.1 score is 7.1, reflecting potential confidentiality and availability impact without integrity impact.
Likely exposure
Exposure requires a vulnerable Linux kernel, local low-privileged access, and relevant io_uring functionality. The bundle identifies affected releases around Linux 6.19 through 6.19.11 and 7.0, but administrators should confirm exact distribution-specific ranges with their vendor.
Exploitation context
The supplied record is not in CISA KEV and provides no evidence of active exploitation. CVSS classifies the attack as local, low complexity, low privilege, and requiring no user interaction. Public fix commits confirm the defect, but the bundle does not establish practical exploit reliability.
Researcher notes
The faulty check uses incremented sq_head rather than the computed sq_idx. Because sq_head advances only for 128-byte entries, sq_idx can reference the final slot while the check misses the required wrap. The correction checks sq_idx directly while retaining sq_head advancement to skip the entry’s second half.
Mitigation direction
Apply a vendor-supported kernel update containing the referenced upstream fix.
Confirm distribution-specific affected and fixed versions before scheduling deployment.
Prioritize multi-user systems and workloads allowing untrusted local code.
Use vendor guidance for interim controls if immediate kernel replacement is impractical.
Validation and detection
Inventory running kernel builds across hosts and container platforms.
Compare vendor changelogs against fix commits ba21ab247a5b and 5170efd9c344.
Determine whether untrusted users or workloads can access io_uring locally.
After updating, verify hosts booted into the corrected kernel build.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-31484 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
0ADP providers
3Source links
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.