CVE-2026-31405: media: dvb-net: fix OOB access in ULE extension header tables
In the Linux kernel, the following vulnerability has been resolved:
media: dvb-net: fix OOB access in ULE extension header tables
The ulemandatoryexthandlers[] and uleoptionalexthandlers[] tables in handleoneuleextension() are declared with 255 elements (valid indices 0-254), but the index htype is derived from network-controlled data as (ulesndutype & 0x00FF), giving a range of 0-255. When htype equals 255, an out-of-bounds read occurs on the function pointer table, and the OOB value may be called as a function pointer.
Add a bounds check on htype against the array size before either table is accessed. Out-of-range values now cause the SNDU to be discarded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In handle_one_ule_extension(), add a bounds check on htype against the size of the ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables before either table is accessed, and discard the SNDU when htype is out of range.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31405?
CVE-2026-31405 has been classified with a severity rating that impacts the stability and security of systems using the affected Linux kernel.
How do I fix CVE-2026-31405?
To fix CVE-2026-31405, update your Linux kernel to the latest version provided by your distribution that includes the patch for this vulnerability.
What systems are affected by CVE-2026-31405?
CVE-2026-31405 affects various versions of the Linux kernel that utilize the dvb-net functionality.
What are the risks associated with CVE-2026-31405?
The risks of CVE-2026-31405 include potential out-of-bounds access vulnerabilities that may lead to system crashes or unauthorized access.
How can I verify if my Linux kernel is vulnerable to CVE-2026-31405?
You can verify if your Linux kernel is vulnerable to CVE-2026-31405 by checking the version against known vulnerable versions published by the Linux community.