CVE-2026-31619

{"id": "CVE-2026-31619", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31619", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:22:46.214544Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a", "lessThan": "183aa0de0f680496b9feb85c9d182681ad4600dd", "versionType": "git"}, {"status": "affected", "version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a", "lessThan": "62fcb273fbee5b2a0e7ed41cc914c8d7d1a5d285", "versionType": "git"}, {"status": "affected", "version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a", "lessThan": "327f8e730e3c65ec97df9d3b07de66aeb3dc932d", "versionType": "git"}, {"status": "affected", "version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a", "lessThan": "f856f4b6efd51be7950e4b84c06cd961961ca41c", "versionType": "git"}, {"status": "affected", "version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a", "lessThan": "e103f98f6615ed2934e9cf340654f0cad9eb8a8a", "versionType": "git"}, {"status": "affected", "version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a", "lessThan": "67cfd14074cdafab5de3f7cfc0952c1a9b653e5d", "versionType": "git"}, {"status": "affected", "version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a", "lessThan": "cc624b3d2be13297100539b64ad950695188e046", "versionType": "git"}, {"status": "affected", "version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a", "lessThan": "682d8accf0d83a871e8c327b95c81f53902c922b", "versionType": "git"}, {"status": "affected", "version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a", "lessThan": "07704bbf36f57e4379e4cadf96410dab14621e3b", "versionType": "git"}], "programFiles": ["sound/firewire/fireworks/fireworks_command.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.16"}, {"status": "unaffected", "version": "0", "lessThan": "3.16", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.136", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.83", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.24", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.14", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0.1", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["sound/firewire/fireworks/fireworks_command.c"], "defaultStatus": "affected"}]}], "published": "2026-04-24T15:16:41.180", "references": [{"url": "https://git.kernel.org/stable/c/07704bbf36f57e4379e4cadf96410dab14621e3b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/183aa0de0f680496b9feb85c9d182681ad4600dd", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/327f8e730e3c65ec97df9d3b07de66aeb3dc932d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/62fcb273fbee5b2a0e7ed41cc914c8d7d1a5d285", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/67cfd14074cdafab5de3f7cfc0952c1a9b653e5d", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/682d8accf0d83a871e8c327b95c81f53902c922b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cc624b3d2be13297100539b64ad950695188e046", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e103f98f6615ed2934e9cf340654f0cad9eb8a8a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f856f4b6efd51be7950e4b84c06cd961961ca41c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: fireworks: bound device-supplied status before string array lookup\n\nThe status field in an EFW response is a 32-bit value supplied by the\nfirewire device. efr_status_names[] has 17 entries so a status value\noutside that range goes off into the weeds when looking at the %s value.\n\nEven worse, the status could return EFR_STATUS_INCOMPLETE which is\n0x80000000, and is obviously not in that array of potential strings.\n\nFix this up by properly bounding the index against the array size and\nprinting \"unknown\" if it's not recognized."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: fireworks: acotar el estado proporcionado por el dispositivo antes de la b\u00fasqueda en el array de cadenas\n\nEl campo de estado en una respuesta EFW es un valor de 32 bits proporcionado por el dispositivo firewire. efr_status_names[] tiene 17 entradas, por lo que un valor de estado fuera de ese rango se desv\u00eda al observar el valor %s.\n\nPeor a\u00fan, el estado podr\u00eda devolver EFR_STATUS_INCOMPLETE, que es 0x 80000000, y obviamente no est\u00e1 en ese array de cadenas potenciales.\n\nEsto se soluciona acotando correctamente el \u00edndice con respecto al tama\u00f1o del array e imprimiendo \u2019desconocido\u2019 si no es reconocido."}], "lastModified": "2026-11-11T23:10:00.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7482AD77-8977-4A6A-96C0-1B7E86AC25E9", "versionEndExcluding": "6.6.136", "versionStartIncluding": "3.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8", "versionEndExcluding": "6.12.83", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A", "versionEndExcluding": "7.0.1", "versionStartIncluding": "7.0"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}