PT-2026-34410 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-31505

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the iavf driver where the iavf get ethtool stats() function incorrectly uses the num active queues variable, while iavf get sset count() and iavf get stat strings() use real num tx queues. This inconsistency can trigger out-of-bounds writes when changing channels and requesting statistics simultaneously, as the value of real num tx queues can change during runtime.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31505

Affected Products

Linux Kernel

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-31505 · Security Note
• https://git.kernel.org/stable/c/fdf902bf86a80bf15792a1d20a67a5302498d7f1 · Note
• https://git.kernel.org/stable/c/bb85741d2dc2be207353a412f51b83697fcbefcf · Note
• https://git.kernel.org/stable/c/fecacfc95f195b99c71c579a472120d0b4ed65fa · Note
• https://twitter.com/CVEnew/status/2046979969650221183 · Twitter Post
• https://git.kernel.org/stable/c/1f931dee5b726df1940348ec31614d64bac03aa6 · Note