CVE-2026-31521

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

module: Fix kernel panic when a symbol st_shndx is out of bounds

The module loader doesn't check for bounds of the ELF section index in

simplify_symbols():

for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {

const char *name = info->strtab + sym[i].st_name;

switch (sym[i].st_shndx) {

case SHN_COMMON:

[...]

default:

/* Divert to percpu allocation if a percpu var. */

if (sym[i].st_shndx == info->index.pcpu)

secbase = (unsigned long)mod_percpu(mod);

else

/** HERE --> **/ secbase = info->sechdrs[sym[i].st_shndx].sh_addr;

sym[i].st_value += secbase;

break;

}

}

A symbol with an out-of-bounds st_shndx value, for example 0xffff

(known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic:

BUG: unable to handle page fault for address: ...

RIP: 0010:simplify_symbols+0x2b2/0x480

...

Kernel panic - not syncing: Fatal exception

This can happen when module ELF is l

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References