PT-2026-34969 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-05-06 · CVE-2026-31617

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ncm unwrap ntb() function where the block len read from the host-supplied NTB header lacks a lower bound check. When block len is smaller than opts->ndp size, the bounds check ndp index > (block len - opts->ndp size) underflows, creating a large unsigned value that bypasses the check. A similar underflow occurs during datagram index checks against block len - opts->dpe size. This allows a malicious USB host to specify ndp index and datagram offsets that point beyond the actual transfer, leading the skb put data() function to copy adjacent kernel memory into the network skb.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31617

ECHO-F393-A6CC-1064

OPENSUSE-SU-2026:10703-1

Affected Products

Linux Kernel

References · 78

• https://git.kernel.org/stable/c/8f993d30b95dc9557a8a96ceca11abed674c8acb · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31617 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10703-1 · Vendor Advisory
• https://git.kernel.org/stable/c/0f156bb5334e588034ca68ac2ee92b23f66e56e7 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31617 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31617 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31617 · Security Note
• https://git.kernel.org/stable/c/6762f8a95772265dd0c2ffe7f400493f3115b135 · Patch
• https://git.kernel.org/stable/c/8757a2593631443648218244b9788e193ae0fdc1 · Patch
• https://ubuntu.com/security/CVE-2026-31617 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31617 · Vendor Advisory
• https://git.kernel.org/stable/c/d58ba8f6546232f8414f396c189297dbee03f1a7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31617 · Security Note
• https://git.kernel.org/stable/c/74908b0318d1df1188457040b8714ff4d4b68126 · Patch
• https://suse.com/security/cve/CVE-2026-31577 · Note