CVE-2026-31405: media: dvb-net: fix OOB access in ULE extension header tables
In the Linux kernel, the following vulnerability has been resolved:
media: dvb-net: fix OOB access in ULE extension header tables
The ulemandatoryexthandlers[] and uleoptionalexthandlers[] tables in handleoneuleextension() are declared with 255 elements (valid indices 0-254), but the index htype is derived from network-controlled data as (ulesndutype & 0x00FF), giving a range of 0-255. When htype equals 255, an out-of-bounds read occurs on the function pointer table, and the OOB value may be called as a function pointer.
Add a bounds check on htype against the array size before either table is accessed. Out-of-range values now cause the SNDU to be discarded.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31405?
CVE-2026-31405 has been classified with a severity rating that impacts the stability and security of systems using the affected Linux kernel.
How do I fix CVE-2026-31405?
To fix CVE-2026-31405, update your Linux kernel to the latest version provided by your distribution that includes the patch for this vulnerability.
What systems are affected by CVE-2026-31405?
CVE-2026-31405 affects various versions of the Linux kernel that utilize the dvb-net functionality.
What are the risks associated with CVE-2026-31405?
The risks of CVE-2026-31405 include potential out-of-bounds access vulnerabilities that may lead to system crashes or unauthorized access.
How can I verify if my Linux kernel is vulnerable to CVE-2026-31405?
You can verify if your Linux kernel is vulnerable to CVE-2026-31405 by checking the version against known vulnerable versions published by the Linux community.