PT-2026-34369 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-31464

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds access issue exists in the ibmvfc discover targets done() function. A compromised VIO server can provide a num written value in the discover targets MAD response that exceeds max targets. This value is stored in vhost->num targets without validation and used as a loop bound in ibmvfc alloc targets() to index into disc buf[], which is only allocated for max targets entries. This allows access to kernel memory outside the DMA-coherent allocation, which is then leaked back to the VIO server via Implicit Logout and PLOGI MADs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-31464

ECHO-497E-0F2E-7B64

Affected Products

Linux Kernel

References · 18

• https://ubuntu.com/security/CVE-2026-31464 · Vendor Advisory
• https://git.kernel.org/stable/c/786f10b1966e485046839f992e89f2c18cbd1983 · Patch
• https://git.kernel.org/stable/c/61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31464 · Vendor Advisory
• https://git.kernel.org/stable/c/a007246cb6c9ebdc93dafbf63cc2d43d98f402cc · Patch
• https://git.kernel.org/stable/c/bae4df0a643fa7f84663473aa3082a9c2ed139db · Patch
• https://git.kernel.org/stable/c/4ed727e35b0ab17d3eeeb1e8023768396e2be161 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-31464 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31464 · Vendor Advisory
• https://git.kernel.org/stable/c/394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89 · Patch
• https://cve.org/CVERecord?id=CVE-2026-31464 · Security Note
• https://git.kernel.org/stable/c/d1466bf991b2343cf2ba8336e440c8faf3cbb780 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31464 · Security Note
• https://git.kernel.org/stable/c/d842348f8a00d5b1d7358f207eb34ffcf5b16df3 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31464 · Vendor Advisory