CyberSecBulletin
CVE-2026-31570NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-31570 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions e7c99348b0612b2bc02d5ce6ff9873261cc7605f, 999ca48d55a8a46da21519db7e834e5867200379, a025283d7f7404c739225e457fb99db2368bb544 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.26% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to e7c99348b0612b2bc02d5ce6ff9873261cc7605f or 999ca48d55a8a46da21519db7e834e5867200379 or a025283d7f7404c739225e457fb99db2368bb544 or 54ecdf76a55e75c1f5085e440f8ab671a3283ef5, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.253 or 5.15.203 or 6.1.168 or 6.6.131, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux456a8a646b2563438c16a9b27decf9aa717f1ebb up to, but not including, e7c99348b0612b2bc02d5ce6ff9873261cc7605f; 456a8a646b2563438c16a9b27decf9aa717f1ebb up to, but not including, 999ca48d55a8a46da21519db7e834e5867200379; 456a8a646b2563438c16a9b27decf9aa717f1ebb up to, but not including, a025283d7f7404c739225e457fb99db2368bb544; 456a8a646b2563438c16a9b27decf9aa717f1ebb up to, but not including, 54ecdf76a55e75c1f5085e440f8ab671a3283ef5; 456a8a646b2563438c16a9b27decf9aa717f1ebb up to, but not including, c4e8eaa75fa0b6bcbfa5356d6195c4ad0e05e57a; 456a8a646b2563438c16a9b27decf9aa717f1ebb up to, but not including, 84f8b76d24273175a22713e83e90874e1880d801; 456a8a646b2563438c16a9b27decf9aa717f1ebb up to, but not including, 66b689efd08227da2c5ca49b58b30a95d23c695a; 456a8a646b2563438c16a9b27decf9aa717f1ebb up to, but not including, b9c310d72783cc2f30d103eed83920a5a29c671a; and 1 more rangese7c99348b0612b2bc02d5ce6ff9873261cc7605f, 999ca48d55a8a46da21519db7e834e5867200379, a025283d7f7404c739225e457fb99db2368bb544, 54ecdf76a55e75c1f5085e440f8ab671a3283ef5, c4e8eaa75fa0b6bcbfa5356d6195c4ad0e05e57a, 84f8b76d24273175a22713e83e90874e1880d801
LinuxLinux Kernel5.4.1 up to, but not including, 5.10.253; 5.11 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.168; 6.2 up to, but not including, 6.6.131; 6.7 up to, but not including, 6.12.80; 6.13 up to, but not including, 6.18.21; 6.19 up to, but not including, 6.19.11; 5.4; and 1 more ranges5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: can: gw: fix OOB heap access in cgw_csum_crc8_rel() cgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx(): int from = calc_idx(crc8->from_idx, cf->len); int to = calc_idx(crc8->to_idx, cf->len); int res = calc_idx(crc8->result_idx, cf->len); if (from < 0 || to < 0 || res < 0) return; However, the loop and the result write then use the raw s8 fields directly instead of the computed variables: for (i = crc8->from_idx; ...) /* BUG: raw negative index */ cf->data[crc8->result_idx] = ...; /* BUG: raw negative index */ With from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame, calc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with i = -64, reading cf->data[-64], and the write goes to cf->data[-64]. This write might end up to 56 (7.0-rc) or 40 (<= 6.19) bytes before the start of the canfd_frame on the heap. The companion function cgw_csum_xor_rel() uses `from`/`to`/`res` correctly throughout; fix cgw_csum_crc8_rel() to match. Confirmed with KASAN on linux-7.0-rc2: BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0 Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62 To configure the can-gw crc8 checksums CAP_NET_ADMIN is needed.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.