CyberSecBulletin
CVE-2026-31779NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-31779 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions f6abac936a0dfd31d6c3e49205ec0ee75a8f887f, ffbed27ba15ef80d1c622eeedbfef03e501ae134, e67d8c626ace80b0fa2b48c8ec0a46b508c93442 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.27% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to f6abac936a0dfd31d6c3e49205ec0ee75a8f887f or ffbed27ba15ef80d1c622eeedbfef03e501ae134 or e67d8c626ace80b0fa2b48c8ec0a46b508c93442 or dd90880eb5ec5442b37eb2b95688f4a63f4883e3, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.1.168 or 6.6.134 or 6.12.81 or 6.18.22, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux5ac54afd4d97ad8d94fe250c83b1924eb6d2268c up to, but not including, f6abac936a0dfd31d6c3e49205ec0ee75a8f887f; 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c up to, but not including, ffbed27ba15ef80d1c622eeedbfef03e501ae134; 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c up to, but not including, e67d8c626ace80b0fa2b48c8ec0a46b508c93442; 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c up to, but not including, dd90880eb5ec5442b37eb2b95688f4a63f4883e3; 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c up to, but not including, ca0e9491b98ca4c5b44204b0b3dd8062a3b5fba2; 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c up to, but not including, 744fabc338e87b95c4d1ff7c95bc8c0f834c6d99; 6.1f6abac936a0dfd31d6c3e49205ec0ee75a8f887f, ffbed27ba15ef80d1c622eeedbfef03e501ae134, e67d8c626ace80b0fa2b48c8ec0a46b508c93442, dd90880eb5ec5442b37eb2b95688f4a63f4883e3, ca0e9491b98ca4c5b44204b0b3dd8062a3b5fba2, 744fabc338e87b95c4d1ff7c95bc8c0f834c6d99
LinuxLinux Kernel6.1 up to, but not including, 6.1.168; 6.2 up to, but not including, 6.6.134; 6.7 up to, but not including, 6.12.81; 6.13 up to, but not including, 6.18.22; 6.19 up to, but not including, 6.19.12; 7.06.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() The memcpy function assumes the dynamic array notif->matches is at least as large as the number of bytes to copy. Otherwise, results->matches may contain unwanted data. To guarantee safety, extend the validation in one of the checks to ensure sufficient packet length. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.