LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31786: Buffer overflow in drivers/xen/sys-hypervisor.c

In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string. The first causes a buffer overflow as sprintf in buildid_show will read and copy till it finds a NUL. 00000000 f4 91 51 f4 dd 38 9e 9d 65 47 52 eb 10 71 db 50 |..Q..8..eGR..q.P| 00000010 b9 a8 01 42 6f 2e 32 |...Bo.2| 00000017 So use a memcpy instead of sprintf to have the correct value: 00000000 f4 91 51 f4 dd 00 9e 9d 65 47 52 eb 10 71 db 50 |..Q.....eGR..q.P| 00000010 b9 a8 01 42 |...B| 00000014 (the above have a hack to embed a zero inside and check it's returned correctly). This is XSA-485 / CVE-2026-31786

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local, low-privileged user may trigger a Linux kernel buffer overflow while Xen build information is displayed. Successful exploitation could compromise confidentiality, integrity, and availability. The supplied evidence does not establish remote exploitation, guest escape, or exploitation in the wild.

Executive priority

Treat this as a high-priority maintenance issue for Xen-connected Linux systems permitting untrusted local access. Accelerate inventory and vendor-kernel updates, while avoiding claims of emergency internet-wide exploitation because the supplied evidence supports only a local attack path and no active exploitation.

Technical view

Xen returns a binary build identifier without guaranteed NUL termination. Linux buildid_show used sprintf as though that value were a string, allowing reads and copying beyond its boundary. The published correction replaces sprintf with length-bounded memcpy, preserving embedded zero bytes and preventing the overflow.

Likely exposure

Exposure is most likely on affected Linux kernels using Xen interfaces where a low-privileged local user can reach the build-ID display path. The supplied version data spans multiple kernel branches, but exact distribution package boundaries are incomplete; confirm status with each Linux vendor.

Exploitation context

CVSS 3.1 rates this 7.8: local access, low complexity, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact. The bundle reports no KEV listing and provides no evidence of active exploitation. It does not demonstrate remote access or a Xen guest escape.

Researcher notes

The defect is an unbounded string operation on a length-delimited binary Xen build ID. Embedded NUL handling is also correctness-relevant. Stable kernel commits are supplied, but the bundle lacks branch-to-commit mapping, distribution backport status, proof-of-concept evidence, and demonstrated exploitation outcomes. Do not infer guest escape from the XSA association alone.

Mitigation direction

  • Update to a vendor kernel incorporating the cited stable fix for the deployed branch.
  • Reboot affected systems into the updated kernel after installation.
  • Limit untrusted local account access until updates are applied.
  • Consult Linux distribution and Xen guidance for branch-specific remediation status.

Validation and detection

  • Inventory Linux kernel versions on systems using Xen interfaces.
  • Confirm vendor advisories or changelogs identify CVE-2026-31786 as fixed.
  • Verify the running kernel includes the bounded memcpy correction in sys-hypervisor.c.
  • After reboot, confirm every affected node runs the remediated kernel.
  • Review kernel logs for faults associated with buildid_show before remediation.
Prepared
Confidence
high
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31786 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-31786Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux84b7625728ea311ea35bdaa0eded53c1c56baeaa, 84b7625728ea311ea35bdaa0eded53c1c56baeaa, 84b7625728ea311ea35bdaa0eded53c1c56baeaa, 84b7625728ea311ea35bdaa0eded53c1c56baeaa, 84b7625728ea311ea35bdaa0eded53c1c56baeaa, 84b7625728ea311ea35bdaa0eded53c1c56baeaa, 84b7625728ea311ea35bdaa0eded53c1c56baeaa, 84b7625728ea311ea35bdaa0eded53c1c56baeaaunaffected
LinuxLinux4.13, 0, 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.26, 7.0.3, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.