PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31649 Linux CVE debrief

The Linux kernel was vulnerable to an integer underflow issue in the stmmac network driver. The vulnerability occurred in the jumbo_frm() implementation, which unconditionally computed a length value that could wrap around as an unsigned integer when a packet had a small linear portion but a large total length due to page fragments. This led to a potential kernel memory disclosure and memory corruption from hardware on IOMMU-less SoCs. The issue has been resolved by introducing a buf_len local variable clamped to min(nopaged_len, bmax).

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-14
Original CVE updated
2026-07-28
Advisory published
2026-07-14
Advisory updated
2026-07-28

Who should care

Users of Linux kernel versions from 3.2.1 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.169, 6.2 to 6.6.135, 6.7 to 6.12.82, 6.13 to 6.18.23, 6.19 to 6.19.13, and 7.0 rc1 to rc7 should apply patches or mitigations.

Technical summary

The jumbo_frm() chain-mode implementation in the stmmac network driver unconditionally computed len = nopaged_len - bmax, where nopaged_len = skb_headlen(skb) and bmax is BUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit() decides to invoke jumbo_frm() based on skb->len. When a packet has a small linear portion (nopaged_len <= bmax) but a large total length due to page fragments (skb->len > bmax), the subtraction wraps as an unsigned integer, producing a huge len value. This causes the while (len != 0) loop to execute hundreds of thousands of iterations, passing skb->data + bmax * i pointers far beyond the skb buffer to dma_map_single(). On IOMMU-less SoCs, this maps arbitrary kernel memory to the DMA engine, constituting a kernel memory disclosure and potential memory corruption from hardware.

Defensive priority

High

Recommended defensive actions

  • Apply patches from Linux kernel stable branches
  • Inventory and update affected Linux kernel versions
  • Monitor for unusual DMA activity
  • Implement compensating controls for IOMMU-less SoCs
  • Exception tracking for potential memory corruption

Evidence notes

The CVE record was published on 2026-04-24T15:16:44.330Z and last modified on 2026-07-14T13:18:46.557Z. Multiple patches are available from the Linux kernel stable branches. Linux kernel versions from 3.2.1 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.169, 6.2 to 6.6.135, 6.7 to 6.12.82, 6.13 to 6.18.23, 6.19 to 6.19.13, and 7.0 rc1 to rc7 are potentially affected. Users should verify specific version exposure and apply patches or mitigations accordingly. Evidence is limited to public CVE and NVD details.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-31649 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-31649

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-31649 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-31649

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/10d12b9240ebf96c785f0e2e4228318cd5f3a3eb

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/275bdf762e82082f064e60a92448fa2ac43cf95b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2c91b39912278d0878f9ba60ba04d2518b18a08d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/513e06735f5be575b409d195822195348b164e48

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/51f4e090b9f87b40c21b6daadb5c06e6c0a07b67

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6fca757c20396dc2e604dcc61922264e9e3dc803

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a2b68a9a476b9544ff31f1fbcd5d80867a8a5e2f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.