CVE-2026-31405
media: dvb-net: fix OOB access in ULE extension header tables
Description
In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables in handle_one_ule_extension() are declared with 255 elements (valid indices 0-254), but the index htype is derived from network-controlled data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When htype equals 255, an out-of-bounds read occurs on the function pointer table, and the OOB value may be called as a function pointer. Add a bounds check on htype against the array size before either table is accessed. Out-of-range values now cause the SNDU to be discarded.
INFO
Published Date :
April 6, 2026, 8:16 a.m.
Last Modified :
April 27, 2026, 2:16 p.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the latest version.
- Ensure the patch for this vulnerability is applied.
- Discard SNDUs with out-of-range header types.
Public PoC/Exploit Available at Github
CVE-2026-31405 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-31405.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-31405 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-31405
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CVE's I found. technical writeups, expolitation examples and fuzzing sessions walkthroughs
cve open-source-security vulnerability
GDB Python C
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-31405 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-31405 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 27, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 18, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/b2bd2ee73b697c177157bba534e1b1064c2e66a0 Added Reference https://git.kernel.org/stable/c/e51238718217c4abdb3ccc3b0c0cde265c7ec629 -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 06, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables in handle_one_ule_extension() are declared with 255 elements (valid indices 0-254), but the index htype is derived from network-controlled data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When htype equals 255, an out-of-bounds read occurs on the function pointer table, and the OOB value may be called as a function pointer. Add a bounds check on htype against the array size before either table is accessed. Out-of-range values now cause the SNDU to be discarded. Added Reference https://git.kernel.org/stable/c/145e50c2c700fa52b840df7bab206043997dd18e Added Reference https://git.kernel.org/stable/c/1a6da3dbb9985d00743073a1cc1f96e59f5abc30 Added Reference https://git.kernel.org/stable/c/24d87712727a5017ad142d63940589a36cd25647 Added Reference https://git.kernel.org/stable/c/29ef43ceb121d67b87f4cbb08439e4e9e732eff8 Added Reference https://git.kernel.org/stable/c/8bde543d2a5f935ba2a6a6325a2e02f8a9256fbe Added Reference https://git.kernel.org/stable/c/f2b65dcb78c8990e4c68a906627433be1fe38a92