CVE-2026-31505

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()

iavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the

value could change in runtime, we should use num_tx_queues instead.

Moreover iavf_get_ethtool_stats() uses num_active_queues while

iavf_get_sset_count() and iavf_get_stat_strings() use

real_num_tx_queues, which triggers out-of-bounds writes when we do

"ethtool -L" and "ethtool -S" simultaneously [1].

For example when we change channels from 1 to 8, Thread 3 could be

scheduled before Thread 2, and out-of-bounds writes could be triggered

in Thread 3:

Thread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S)

iavf_set_channels()

...

iavf_alloc_queues()

-> num_active_queues = 8

iavf_schedule_finish_config()

iavf_get_sset_count()

real_num_tx_queues: 1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References