CVE-2026-31395

{"id": "CVE-2026-31395", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "84fcd9449fd7882ddfb05ba64d75f9be2d29b2e9", "lessThan": "19aa416eed9e4aaf1bbe8da0f7bd9a9be31158c8", "versionType": "git"}, {"status": "affected", "version": "84fcd9449fd7882ddfb05ba64d75f9be2d29b2e9", "lessThan": "b7c7a275447c6d4bf4a36a134682e2e4e20efd4b", "versionType": "git"}, {"status": "affected", "version": "84fcd9449fd7882ddfb05ba64d75f9be2d29b2e9", "lessThan": "64dcbde7f8f870a4f2d9daf24ffb06f9748b5dd3", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c", "drivers/net/ethernet/broadcom/bnxt/bnxt.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"status": "unaffected", "version": "0", "lessThan": "6.13", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.20", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.10", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c", "drivers/net/ethernet/broadcom/bnxt/bnxt.h"], "defaultStatus": "affected"}]}], "published": "2026-04-03T16:16:37.743", "references": [{"url": "https://git.kernel.org/stable/c/19aa416eed9e4aaf1bbe8da0f7bd9a9be31158c8", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/64dcbde7f8f870a4f2d9daf24ffb06f9748b5dd3", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b7c7a275447c6d4bf4a36a134682e2e4e20efd4b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler\n\nThe ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER handler in\nbnxt_async_event_process() uses a firmware-supplied 'type' field\ndirectly as an index into bp->bs_trace[] without bounds validation.\n\nThe 'type' field is a 16-bit value extracted from DMA-mapped completion\nring memory that the NIC writes directly to host RAM. A malicious or\ncompromised NIC can supply any value from 0 to 65535, causing an\nout-of-bounds access into kernel heap memory.\n\nThe bnxt_bs_trace_check_wrap() call then dereferences bs_trace->magic_byte\nand writes to bs_trace->last_offset and bs_trace->wrapped, leading to\nkernel memory corruption or a crash.\n\nFix by adding a bounds check and defining BNXT_TRACE_MAX as\nDBG_LOG_BUFFER_FLUSH_REQ_TYPE_ERR_QPC_TRACE + 1 to cover all currently\ndefined firmware trace types (0x0 through 0xc)."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbnxt_en: correcci\u00f3n de acceso fuera de l\u00edmites en el gestor de eventos as\u00edncronos DBG_BUF_PRODUCER\n\nEl gestor ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER en bnxt_async_event_process() utiliza un campo 'type' proporcionado por el firmware directamente como un \u00edndice en bp -> bs_trace[] sin validaci\u00f3n de l\u00edmites.\n\nEl campo 'type' es un valor de 16 bits extra\u00eddo de la memoria del anillo de finalizaci\u00f3n mapeada por DMA que la NIC escribe directamente en la RAM del host. Una NIC maliciosa o comprometida puede proporcionar cualquier valor de 0 a 65535, causando un acceso fuera de l\u00edmites en la memoria del heap del kernel.\n\nLa llamada a bnxt_bs_trace_check_wrap() luego desreferencia bs_trace -> magic_byte y escribe en bs_trace -> last_offset y bs_trace -> wrapped, lo que lleva a corrupci\u00f3n de memoria del kernel o a un fallo.\n\nSoluci\u00f3n mediante la adici\u00f3n de una comprobaci\u00f3n de l\u00edmites y la definici\u00f3n de BNXT_TRACE_MAX como DBG_LOG_BUFFER_FLUSH_REQ_TYPE_ERR_QPC_TRACE + 1 para cubrir todos los tipos de traza de firmware actualmente definidos (de 0x0 a 0xc)."}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5571059-6552-48E7-9BEF-3E358C387171", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}