Security readout for executives and security teams
Plain-English summary
A Linux kernel IOMMU page-table flaw can invalidate less memory-mapping state than was actually unmapped. Stale device translations could theoretically threaten confidentiality, integrity, or availability. The supplied assessment rates it CVSS 8.8, but the kernel description says the condition is likely not triggerable because known callers do not rely on the relevant behavior.
Executive priority
Treat this as a high-severity maintenance item, especially for virtualization or device-isolation hosts. Accelerate vendor-supported patching, but current evidence does not justify an exploitation-driven emergency response. Reassess promptly if vendors confirm reachable configurations or exploitation.
Technical view
When an unmap endpoint falls inside a large or contiguous I/O page-table entry, more may be unmapped than requested. The gather logic flushed only the requested range, creating a short invalidation and potentially leaving stale IOMMU translations. The referenced stable-kernel commits resolve the range-accounting error.
Likely exposure
The bundle identifies Linux 6.19, 6.19.12, and 7.0 as affected, but its version-range structure is ambiguous. Exposure requires the vulnerable iommupt code and a caller reaching the unusual large-entry unmap condition. Confirm exact applicability with the Linux or distribution vendor.
Exploitation context
The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a practical exploit. The kernel description explicitly considers the bug likely untriggerable based on known usage. Local access and low privileges appear in the supplied CVSS vector, but practical reachability remains unproven.
Researcher notes
The key issue is mismatch between the actual expanded unmap range and the gathered invalidation range. Testing should focus on endpoints inside large or contiguous IOPTEs without developing weaponized payloads. The source reports discovery through new invalidation/gather testing and says known behavior likely prevents triggering. Affected-version boundaries remain insufficiently clear in the bundle.
Mitigation direction
- Apply a vendor-supported kernel update incorporating the referenced stable-kernel fixes.
- Check distribution advisories for exact affected builds and backport status.
- Prioritize systems using IOMMU page-table functionality or device isolation.
- If updates are unavailable, request vendor-specific mitigation guidance.
Validation and detection
- Inventory running kernel versions and distribution package revisions.
- Confirm whether vendor packages include either referenced corrective commit or an equivalent backport.
- Review IOMMU usage and device-assignment configurations on potentially affected hosts.
- After updating, verify the fixed kernel is running following reboot.
- Monitor vendor advisories for clarified version ranges or exploitation evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31735 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/50ecd96a28f712f8b682c0441f4cb9b086d28816CVE reference, Linux
- https://git.kernel.org/stable/c/ee6e69d032550687a3422504bfca3f834c7b5061CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.