CyberSecBulletin
CVE-2026-31778NVD status: Analyzed

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-31778 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 02d9c5b0b5553a391448b6d655262bd829f90234, 3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6, 66194c2575a4f567577ae70b1d7561163ce791a6 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 02d9c5b0b5553a391448b6d655262bd829f90234 or 3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6 or 66194c2575a4f567577ae70b1d7561163ce791a6 or a82c1bce2d1299dd3c686a8fe48cf75b79a403c7, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.253 or 5.15.203 or 6.1.168 or 6.6.134, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxbafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a up to, but not including, 02d9c5b0b5553a391448b6d655262bd829f90234; bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a up to, but not including, 3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6; bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a up to, but not including, 66194c2575a4f567577ae70b1d7561163ce791a6; bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a up to, but not including, a82c1bce2d1299dd3c686a8fe48cf75b79a403c7; bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a up to, but not including, 3178b62e2e31bab39f63d4c8e54bf4ee0a425627; bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a up to, but not including, 3afa2e67f3523a980a2f90fd63c22322ac2b9ce0; bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a up to, but not including, 7594a6464873d90fd229e5b94cdd3b92c9feabed; bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a up to, but not including, 45424e871abf2a152e247a9cff78359f18dd95c0; and 1 more ranges02d9c5b0b5553a391448b6d655262bd829f90234, 3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6, 66194c2575a4f567577ae70b1d7561163ce791a6, a82c1bce2d1299dd3c686a8fe48cf75b79a403c7, 3178b62e2e31bab39f63d4c8e54bf4ee0a425627, 3afa2e67f3523a980a2f90fd63c22322ac2b9ce0
LinuxLinux Kernel2.6.31 up to, but not including, 5.10.253; 5.11 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.168; 6.2 up to, but not including, 6.6.134; 6.7 up to, but not including, 6.12.81; 6.13 up to, but not including, 6.18.22; 6.19 up to, but not including, 6.19.12; 7.05.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix stack out-of-bounds read in init_card The loop creates a whitespace-stripped copy of the card shortname where `len < sizeof(card->id)` is used for the bounds check. Since sizeof(card->id) is 16 and the local id buffer is also 16 bytes, writing 16 non-space characters fills the entire buffer, overwriting the terminating nullbyte. When this non-null-terminated string is later passed to snd_card_set_id() -> copy_valid_id_string(), the function scans forward with `while (*nid && ...)` and reads past the end of the stack buffer, reading the contents of the stack. A USB device with a product name containing many non-ASCII, non-space characters (e.g. multibyte UTF-8) will reliably trigger this as follows: BUG: KASAN: stack-out-of-bounds in copy_valid_id_string sound/core/init.c:696 [inline] BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c sound/core/init.c:718 The off-by-one has been present since commit bafeee5b1f8d ("ALSA: snd_usb_caiaq: give better shortname") from June 2009 (v2.6.31-rc1), which first introduced this whitespace-stripping loop. The original code never accounted for the null terminator when bounding the copy. Fix this by changing the loop bound to `sizeof(card->id) - 1`, ensuring at least one byte remains as the null terminator.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.