CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
In the Linux kernel, the following vulnerability has been resolved:
iavf: fix out-of-bounds writes in iavfgetethtoolstats()
iavf incorrectly uses realnumtxqueues for ETHSSSTATS. Since the value could change in runtime, we should use numtxqueues instead.
Moreover iavfgetethtoolstats() uses numactivequeues while iavfgetssetcount() and iavfgetstatstrings() use realnumtxqueues, which triggers out-of-bounds writes when we do "ethtool -L" and "ethtool -S" simultaneously [1].
For example when we change channels from 1 to 8, Thread 3 could be scheduled before Thread 2, and out-of-bounds writes could be triggered in Thread 3:
Thread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S) iavfsetchannels() ... iavfallocqueues() -> numactivequeues = 8 iavfschedulefinishconfig() iavfgetssetcount() realnumtxqueues: 1 -> buffer for 1 queue iavfgetethtoolstats() numactivequeues: 8 -> out-of-bounds! iavffinishconfig() -> realnumtxqueues = 8
Use immutable numtxqueues in all related functions to avoid the issue.
[1] BUG: KASAN: vmalloc-out-of-bounds in iavfaddoneethtoolstat+0x200/0x270 Write of size 8 at addr ffffc900031c9080 by task ethtool/5800
CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x6f/0xb0 printreport+0x170/0x4f3 kasanreport+0xe1/0x180 iavfaddoneethtoolstat+0x200/0x270 iavfgetethtoolstats+0x14c/0x2e0 devethtool+0x3d0c/0x5830 devethtool+0x12d/0x270 devioctl+0x53c/0xe30 sockdoioctl+0x1a9/0x270 sockioctl+0x3d4/0x5e0 x64sysioctl+0x137/0x1c0 dosyscall64+0xf3/0x690 entrySYSCALL64afterhwframe+0x77/0x7f RIP: 0033:0x7f7da0e6e36d ... </TASK>
The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at devethtool+0x3cc9/0x5830 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88813a013de0 pfn:0x13a013 flags: 0x200000000000000(node=0|zone=2) raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address: ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify iavf to use immutable num_tx_queues in all related functions (including iavf_get_ethtool_stats() / ETH_SS_STATS) to avoid out-of-bounds writes caused by runtime-changing real_num_tx_queues/num_active_queues when handling concurrent ethtool -L / ethtool -S channel/queue changes.
iavf (Intel iavf network driver) ethtool stats code paths Use immutable num_tx_queues instead of real_num_tx_queues/num_active_queues in related ethtool statistics functions = Immutable num_tx_queues for ETH_SS_STATS and all related functions (use num_tx_queues consistently)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31505?
The severity of CVE-2026-31505 is high, with a CVSS score of 7.8.
How do I fix CVE-2026-31505?
To fix CVE-2026-31505, you need to apply the available patch for the Linux kernel.
What is CVE-2026-31505 about?
CVE-2026-31505 addresses an out-of-bounds write vulnerability in the iavf driver of the Linux kernel.
Which software is affected by CVE-2026-31505?
CVE-2026-31505 affects the Linux kernel, specifically the iavf driver.
When was CVE-2026-31505 published?
CVE-2026-31505 was published on April 22, 2026.