CVE-2026-31494

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: macb: use the current queue number for stats

There's a potential mismatch between the memory reserved for statistics

and the amount of memory written.

gem_get_sset_count() correctly computes the number of stats based on the

active queues, whereas gem_get_ethtool_stats() indiscriminately copies

data using the maximum number of queues, and in the case the number of

active queues is less than MACB_MAX_QUEUES, this results in a OOB write

as observed in the KASAN splat.

==================================================================

BUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78

[macb]

Write of size 760 at addr ffff80008080b000 by task ethtool/1027

CPU: [...]

Tainted: [E]=UNSIGNED_MODULE

Hardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025

Call trace:

show_stack+0x20/0x38 (C)

dump_stack_lvl+0x80/0xf8

print_report+0x384/0x5e0

kasan_report+0xa0/0xf0

kasan_check_range+0xe8/0x190

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References