CVE-2026-31690

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

firmware: thead: Fix buffer overflow and use standard endian macros

Addresses two issues in the TH1520 AON firmware protocol driver:

1. Fix a potential buffer overflow where the code used unsafe pointer

arithmetic to access the 'mode' field through the 'resource' pointer

with an offset. This was flagged by Smatch static checker as:

"buffer overflow 'data' 2 <= 3"

2. Replace custom RPC_SET_BE* and RPC_GET_BE* macros with standard

kernel endianness conversion macros (cpu_to_be16, etc.) for better

portability and maintainability.

The functionality was re-tested with the GPU power-up sequence,

confirming the GPU powers up correctly and the driver probes

successfully.

[ 12.702370] powervr ffef400000.gpu: [drm] loaded firmware

powervr/rogue_36.52.104.182_v1.fw

[ 12.711043] powervr ffef400000.gpu: [drm] FW version v1.0 (build

6645434 OS)

[ 12.719787] [drm] Initialized powervr 1.0.0 for ffef400000.gp

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References