Out-of-Bounds Write Vulnerability in Linux Kernel Affecting iavf Component

CVE-2026-31505

What is CVE-2026-31505?

A vulnerability in the iavf component of the Linux kernel can lead to out-of-bounds writes, particularly when the 'ethtool' commands 'ethtool -L' and 'ethtool -S' are executed simultaneously. This arises because of an improper usage of real_num_tx_queues during runtime, which can result in a mismatch between the expected and actual number of active queues. To mitigate this risk, the num_tx_queues value should be consistently employed across all related functions, ensuring that boundary checks are properly enforced and preventing potential memory corruption.

References