Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s MACB/GEM network driver can write beyond an allocated statistics buffer when fewer queues are active than the driver’s maximum. This may corrupt kernel memory. The supplied CVSS rates potential confidentiality, integrity, and availability impact as high, but requires local, low-privileged access.
Executive priority
Treat as an expedited kernel-maintenance issue for systems using the affected driver, especially shared, appliance, or industrial hosts with untrusted local access. It is not evidence of an internet-wide emergency because the supplied assessment requires local access and reports no active exploitation.
Technical view
gem_get_sset_count() allocates statistics space using active queues, while gem_get_ethtool_stats() previously copied statistics for MACB_MAX_QUEUES. The mismatch causes a vmalloc out-of-bounds write during Ethernet statistics retrieval. The kernel fix limits copying to the current active queue count.
Likely exposure
Exposure is limited to Linux systems using the MACB/GEM network driver where active queues are fewer than MACB_MAX_QUEUES. The supplied version data is ambiguous and includes commit identifiers, so inventory should rely on distributor advisories and presence of the referenced stable fix.
Exploitation context
The CVSS vector describes local attack access, low complexity, low privileges, and no user interaction. The supplied record reports a KASAN-detected out-of-bounds write. It does not establish practical exploitation, public weaponization, or active exploitation, and the CVE is not listed as KEV in the bundle.
Researcher notes
The evidence demonstrates a size-accounting mismatch and KASAN-observed vmalloc out-of-bounds write of 760 bytes in gem_get_ethtool_stats(). Impact beyond memory corruption is inferred by the CVSS assessment, not demonstrated in the supplied description. Exact vulnerable release boundaries remain unclear from the provided version entries.
Mitigation direction
- Install a vendor-supported kernel containing the applicable referenced stable fix.
- Check Linux distributor and appliance-vendor advisories for exact affected and corrected releases.
- Prioritize systems exposing local access to untrusted or minimally privileged users.
- Restrict unnecessary local accounts until affected systems are updated.
Validation and detection
- Inventory systems using the MACB/GEM network driver.
- Record kernel and vendor package versions on potentially affected systems.
- Confirm the applicable stable fix is included or backported by the vendor.
- Review kernel logs for MACB-related KASAN or memory-corruption reports after statistics access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31494 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9738be665544281aa624842812c2fbfed6f88226CVE reference, Linux
- https://git.kernel.org/stable/c/240c5302eed83e34e98db18f6795ee5f40814024CVE reference, Linux
- https://git.kernel.org/stable/c/9596759a84e1dbf2670518d85e969208960041f9CVE reference, Linux
- https://git.kernel.org/stable/c/95246341945163ad9a250a87ca5bd1c1252777aeCVE reference, Linux
- https://git.kernel.org/stable/c/9d74d10e4e26672e139a8bcf8bf95957bf2d160fCVE reference, Linux
- https://git.kernel.org/stable/c/7ff87da099210856cbfe2f2f7f52ddfa57af4f0cCVE reference, Linux
- https://git.kernel.org/stable/c/e182fe273cdf5a8931592228196ef514ffac392bCVE reference, Linux
- https://git.kernel.org/stable/c/72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5CVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.