PT-2026-36409 · Linux+3 · Linux+107

Published 2026-05-01 · Updated 2026-05-02 · CVE-2026-31774

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the io uring network component where a slab-out-of-bounds read can occur in the io bundle nbufs() function. This happens when userspace provides a sqe->len value exceeding INT MAX, causing sr->len to overflow into a negative value. This negative value propagates through the receive and send paths, specifically affecting io recv(), io recv buf select(), and io ring buffers peek(). Consequently, an infinite loop is created in io bundle nbufs() that reads past the allocated iov[] array from the kmalloc-64 slab.

Recommendations Reject negative sr->len values early in the io sendmsg prep() and io recvmsg prep() functions.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-31774

Affected Products

Linux

Linux-Allwinner-5.19

Linux-Aws

Linux-Aws-5.0

Linux-Aws-5.11

Linux-Aws-5.13

Linux-Aws-5.19

Linux-Aws-5.3

Linux-Aws-5.8

Linux-Aws-6.14

Linux-Aws-6.17

Linux-Aws-6.2

Linux-Aws-6.5

Linux-Azure

Linux-Azure-5.11

Linux-Azure-5.13

Linux-Azure-5.19

Linux-Azure-5.3

Linux-Azure-5.8

Linux-Azure-6.11

Linux-Azure-6.14

Linux-Azure-6.17

Linux-Azure-6.2

Linux-Azure-6.5

Linux-Azure-Edge

Linux-Azure-Fde

Linux-Azure-Fde-5.19

Linux-Azure-Fde-6.14

Linux-Azure-Fde-6.17

Linux-Azure-Fde-6.2

Linux-Azure-Nvidia-6.14

Linux-Gcp

Linux-Gcp-5.11

Linux-Gcp-5.13

Linux-Gcp-5.19

Linux-Gcp-5.3

Linux-Gcp-5.8

Linux-Gcp-6.11

Linux-Gcp-6.14

Linux-Gcp-6.17

Linux-Gcp-6.2

Linux-Gcp-6.5

Linux-Gke

Linux-Gke-4.15

Linux-Gkeop-5.15

Linux-Gke-5.4

Linux-Gkeop

Linux-Hwe

Linux-Hwe-5.11

Linux-Hwe-5.13

Linux-Hwe-5.19

Linux-Hwe-5.8

Linux-Hwe-6.11

Linux-Hwe-6.14

Linux-Hwe-6.17

Linux-Hwe-6.2

Linux-Hwe-6.5

Linux-Hwe-Edge

Linux-Intel-5.13

Linux-Intel-Iot-Realtime

Linux-Lowlatency-Hwe-5.19

Linux-Lowlatency-Hwe-6.11

Linux-Lowlatency-Hwe-6.2

Linux-Lowlatency-Hwe-6.5

Linux-Lts

Linux-Nvidia

Linux-Nvidia-6.11

Linux-Nvidia-6.2

Linux-Nvidia-6.5

Linux-Oem

Linux-Oem-5.10

Linux-Oem-5.13

Linux-Oem-5.14

Linux-Oem-5.17

Linux-Oem-5.6

Linux-Oem-6.0

Linux-Oem-6.1

Linux-Oem-6.11

Linux-Oem-6.14

Linux-Oem-6.17

Linux-Oem-6.5

Linux-Oem-6.8

Linux-Oracle

Linux-Oracle-5.0

Linux-Oracle-5.11

Linux-Oracle-5.13

Linux-Oracle-5.3

Linux-Oracle-5.8

Linux-Oracle-6.14

Linux-Oracle-6.17

Linux-Oracle-6.5

Linux-Raspi

Linux-Raspi-Realtime

Linux-Raspi2

Linux-Realtime

Linux-Realtime-6.14

Linux-Realtime-6.17

Linux-Riscv

Linux-Riscv-5.11

Linux-Riscv-5.19

Linux-Riscv-5.8

Linux-Riscv-6.14

Linux-Riscv-6.17

Linux-Riscv-6.5

Linux-Starfive-5.19

Linux-Starfive-6.2

Linux-Starfive-6.5

Linux Kernel

References · 13

• https://security-tracker.debian.org/tracker/CVE-2026-31774 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31774 · Security Note
• https://git.kernel.org/stable/c/90ced24c500ad4e129e9e34b7e56fd7849e350b6 · Patch
• https://cve.org/CVERecord?id=CVE-2026-31774 · Security Note
• https://git.kernel.org/stable/c/b948f9d5d3057b01188e36664e7c7604d1c8ecb5 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31774 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31774 · Vendor Advisory
• https://git.kernel.org/stable/c/1b655cd311344117d3052f6552cb20d9901c9d7c · Patch
• https://ubuntu.com/security/CVE-2026-31774 · Vendor Advisory
• https://git.kernel.org/stable/c/c314b405dcc4d8b9041124f928f81715d6328bec · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31774 · Vendor Advisory
• https://docs.bell-sw.com/security/cves/CVE-2026-31774 · Note
• https://git.kernel.org/linus/b948f9d5d3057b01188e36664e7c7604d1c8ecb5 · Note