CVE-2026-31747: comedi: me4000: Fix potential overrun of firmware buffer
In the Linux kernel, the following vulnerability has been resolved:
comedi: me4000: Fix potential overrun of firmware buffer
me4000xilinxdownload() loads the firmware that was requested by requestfirmware(). It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable filelength and reads the data stream contents of length filelength from offset 16 onwards.
Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return -EINVAL.
Note: The firmware loading was totally broken before commit ac584af59945 ("staging: comedi: me4000: fix firmware downloading"), but that is the most sensible target for this fix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In me4000_xilinx_download(), validate that the supplied firmware is long enough to contain the header and the data stream before reading file_length bytes from offset 16; on failure, log an error and return -EINVAL.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31747?
The severity of CVE-2026-31747 is high, with a CVSS score of 7.8.
How do I fix CVE-2026-31747?
You can fix CVE-2026-31747 by applying the available patch for the affected Linux kernel.
What software is affected by CVE-2026-31747?
CVE-2026-31747 affects the Linux kernel, specifically the comedi me4000 driver.
What type of vulnerability is CVE-2026-31747?
CVE-2026-31747 is a buffer overrun vulnerability in the firmware loading process.
When was CVE-2026-31747 published?
CVE-2026-31747 was published on May 1, 2026.