CVE-2026-31464 Details
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() A malicious or compromised VIO server can return a num_written value in the discover targets MAD response that exceeds max_targets. This value is stored directly in vhost->num_targets without validation, and is then used as the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which is only allocated for max_targets entries. Indices at or beyond max_targets access kernel memory outside the DMA-coherent allocation. The out-of-bounds data is subsequently embedded in Implicit Logout and PLOGI MADs that are sent back to the VIO server, leaking kernel memory. Fix by clamping num_written to max_targets before storing it.
A vulnerability allowing out-of-bounds memory access has been identified in the Linux kernel's SCSI IBM Virtual Fibre Channel (ibmvfc) driver. This issue arises because a malicious or compromised Virtual I/O (VIO) server can send a 'num_written' value in the 'discover targets' response that exceeds the maximum number of targets allowed. This unchecked value is then used to index into a buffer that is only allocated for the maximum number of targets, leading to access of kernel memory outside the intended bounds. The out-of-bounds data is subsequently sent back to the VIO server, leaking sensitive kernel memory. The vulnerability has been addressed by adding a validation step to ensure that 'num_written' does not exceed the maximum target limit before it is processed.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for upgrading the Linux kernel can be found in the official Linux documentation or through the package management system of the respective Linux distribution.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89 | kernel.org | Patch |
| https://git.kernel.org/stable/c/4ed727e35b0ab17d3eeeb1e8023768396e2be161 | kernel.org | Patch |
| https://git.kernel.org/stable/c/61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f | kernel.org | Patch |
| https://git.kernel.org/stable/c/786f10b1966e485046839f992e89f2c18cbd1983 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a007246cb6c9ebdc93dafbf63cc2d43d98f402cc | kernel.org | Patch |
| https://git.kernel.org/stable/c/bae4df0a643fa7f84663473aa3082a9c2ed139db | kernel.org | Patch |
| https://git.kernel.org/stable/c/d1466bf991b2343cf2ba8336e440c8faf3cbb780 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d842348f8a00d5b1d7358f207eb34ffcf5b16df3 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.27, < 5.10.253 >= 5.11, < 5.15.203 >= 5.16, < 6.1.168 >= 6.2, < 6.6.131 >= 6.7, < 6.12.80 >= 6.13, < 6.18.21 >= 6.19, < 6.19.11 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 7, 2026 | Initial Analysis | [email protected] |
| Apr 27, 2026 | CVE Modified | kernel.org |
| Apr 22, 2026 | New CVE Received | kernel.org |