LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31484: io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check

In the Linux kernel, the following vulnerability has been resolved: io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check __io_uring_show_fdinfo() iterates over pending SQEs and, for 128-byte SQEs on an IORING_SETUP_SQE_MIXED ring, needs to detect when the second half of the SQE would be past the end of the sq_sqes array. The current check tests (++sq_head & sq_mask) == 0, but sq_head is only incremented when a 128-byte SQE is encountered, not on every iteration. The actual array index is sq_idx = (i + sq_head) & sq_mask, which can be sq_mask (the last slot) while the wrap check passes. Fix by checking sq_idx directly. Keep the sq_head increment so the loop still skips the second half of the 128-byte SQE on the next iteration.

HighCVSS 7.1Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel flaw can read beyond an internal io_uring buffer when process information is inspected. A local, low-privileged user may be able to expose sensitive kernel data or disrupt the system. No remote attack path is identified.

Executive priority

Treat as a high-priority operating-system update, especially on shared compute, hosting, developer, and container-worker systems. It is less urgent than an internet-exploitable issue, but local data disclosure and system disruption could amplify an existing foothold.

Technical view

The io_uring fdinfo handler calculates the wrong wrap condition while iterating mixed-size submission entries. For a 128-byte entry in an IORING_SETUP_SQE_MIXED ring, it may access beyond the sq_sqes array. The published CVSS 3.1 score is 7.1, reflecting potential confidentiality and availability impact without integrity impact.

Likely exposure

Exposure requires a vulnerable Linux kernel, local low-privileged access, and relevant io_uring functionality. The bundle identifies affected releases around Linux 6.19 through 6.19.11 and 7.0, but administrators should confirm exact distribution-specific ranges with their vendor.

Exploitation context

The supplied record is not in CISA KEV and provides no evidence of active exploitation. CVSS classifies the attack as local, low complexity, low privilege, and requiring no user interaction. Public fix commits confirm the defect, but the bundle does not establish practical exploit reliability.

Researcher notes

The faulty check uses incremented sq_head rather than the computed sq_idx. Because sq_head advances only for 128-byte entries, sq_idx can reference the final slot while the check misses the required wrap. The correction checks sq_idx directly while retaining sq_head advancement to skip the entry’s second half.

Mitigation direction

  • Apply a vendor-supported kernel update containing the referenced upstream fix.
  • Confirm distribution-specific affected and fixed versions before scheduling deployment.
  • Prioritize multi-user systems and workloads allowing untrusted local code.
  • Use vendor guidance for interim controls if immediate kernel replacement is impractical.

Validation and detection

  • Inventory running kernel builds across hosts and container platforms.
  • Compare vendor changelogs against fix commits ba21ab247a5b and 5170efd9c344.
  • Determine whether untrusted users or workloads can access io_uring locally.
  • After updating, verify hosts booted into the corrected kernel build.
Prepared
Confidence
medium
Sources
4

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31484 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2026-31484Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1cba30bf9fdd6c982708f3587f609a30c370d889, 1cba30bf9fdd6c982708f3587f609a30c370d889unaffected
LinuxLinux6.19, 0, 6.19.11, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.