Linux Kernel Oversized Global TT Response Buffer Vulnerability

CVE-2026-31659

What is CVE-2026-31659?

A vulnerability in the Linux kernel allows for the acceptance of oversized global TT response buffers, leading to potential heap corruption. When a remote originator advertises a global TT payload that exceeds the allowable size, it can cause the TT payload length combined with the VLAN header offset to exceed the 16-bit limit. This results in a wrapped allocation that is insufficient, causing writes beyond the end of the heap object. The fix involves rejecting TT responses whose TVLV value length does not comply with the expected size, thereby preventing this buffer overflow issue.

References