Linux: Out-of-bounds Read
CVE-2026-31742 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 891d790fdb5c96c6e1d2841e06ee6c360f2d1288, 428fdf55301e6c8fa5a36b426240797b1cf86570, 40014493cece72a0be5672cd86763e53fb3ec613 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 891d790fdb5c96c6e1d2841e06ee6c360f2d1288 or 428fdf55301e6c8fa5a36b426240797b1cf86570 or 40014493cece72a0be5672cd86763e53fb3ec613 or 6.18.22, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.18.22 or 6.19.12, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | c4efef65a46f610418a3f69149c51492d31c8591 up to, but not including, 891d790fdb5c96c6e1d2841e06ee6c360f2d1288; 1cf66bd9127447c57295f5199029e8d8b47c6c67 up to, but not including, 428fdf55301e6c8fa5a36b426240797b1cf86570; 5eb608319bb56464674a71b4a66ea65c6c435d64 up to, but not including, 40014493cece72a0be5672cd86763e53fb3ec613; 6.18.20 up to, but not including, 6.18.22; 6.19.10 up to, but not including, 6.19.12 | 891d790fdb5c96c6e1d2841e06ee6c360f2d1288, 428fdf55301e6c8fa5a36b426240797b1cf86570, 40014493cece72a0be5672cd86763e53fb3ec613, 6.18.22, 6.19.12 |
| Linux | Linux Kernel | 6.18.20 up to, but not including, 6.18.22; 6.19.10 up to, but not including, 6.19.12; 7.0 | 6.18.22, 6.19.12 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: vt: discard stale unicode buffer on alt screen exit after resize When enter_alt_screen() saves vc_uni_lines into vc_saved_uni_lines and sets vc_uni_lines to NULL, a subsequent console resize via vc_do_resize() skips reallocating the unicode buffer because vc_uni_lines is NULL. However, vc_saved_uni_lines still points to the old buffer allocated for the original dimensions. When leave_alt_screen() later restores vc_saved_uni_lines, the buffer dimensions no longer match vc_rows/vc_cols. Any operation that iterates over the unicode buffer using the current dimensions (e.g. csi_J clearing the screen) will access memory out of bounds, causing a kernel oops: BUG: unable to handle page fault for address: 0x0000002000000020 RIP: 0010:csi_J+0x133/0x2d0 The faulting address 0x0000002000000020 is two adjacent u32 space characters (0x20) interpreted as a pointer, read from the row data area past the end of the 25-entry pointer array in a buffer allocated for 80x25 but accessed with 240x67 dimensions. Fix this by checking whether the console dimensions changed while in the alternate screen. If they did, free the stale saved buffer instead of restoring it. The unicode screen will be lazily rebuilt via vc_uniscr_check() when next needed.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How developers prevent this class of flaw
- Use a language that provides appropriate memory abstractions.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Recent Out-of-bounds Read vulnerabilities
- 8.1 High severity
- 8.8 High severity
- 7.1 High severity
- 7.3 High severity
- 7.1 High severity
- 7.1 High severity
Spotted an error? Tell us.