CVE-2026-31690: firmware: thead: Fix buffer overflow and use standard endian macros
In the Linux kernel, the following vulnerability has been resolved:
firmware: thead: Fix buffer overflow and use standard endian macros
Addresses two issues in the TH1520 AON firmware protocol driver:
1. Fix a potential buffer overflow where the code used unsafe pointer arithmetic to access the 'mode' field through the 'resource' pointer with an offset. This was flagged by Smatch static checker as: "buffer overflow 'data' 2 <= 3"
2. Replace custom RPCSETBE and RPCGETBE macros with standard kernel endianness conversion macros (cputobe16, etc.) for better portability and maintainability.
The functionality was re-tested with the GPU power-up sequence, confirming the GPU powers up correctly and the driver probes successfully.
[ 12.702370] powervr ffef400000.gpu: [drm] loaded firmware powervr/rogue36.52.104.182v1.fw [ 12.711043] powervr ffef400000.gpu: [drm] FW version v1.0 (build 6645434 OS) [ 12.719787] [drm] Initialized powervr 1.0.0 for ffef400000.gpu on minor 0
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31690?
CVE-2026-31690 has a medium severity rating due to the potential buffer overflow risks.
How do I fix CVE-2026-31690?
To fix CVE-2026-31690, update your Linux kernel to the latest patched version that addresses this vulnerability.
What systems are affected by CVE-2026-31690?
CVE-2026-31690 affects the TH1520 AON firmware protocol driver in the Linux kernel.
What are the risks associated with CVE-2026-31690?
The risks associated with CVE-2026-31690 include potential buffer overflows that could lead to arbitrary code execution or system crashes.
Is there a workaround for CVE-2026-31690?
There are no specific workarounds for CVE-2026-31690; the best mitigation is to apply the appropriate kernel updates.