high 7.8

CVE-2026-31786 json

Buffer overflow in drivers/xen/sys-hypervisor.c

published 2026-04-30 6 mo ago modified 2026-10-19 20 d ago also EUVD-2026-26364

cvss: 7.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 9%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string.

The first causes a buffer overflow as sprintf in buildid_show will read and copy till it finds a NUL.

00000000 f4 91 51 f4 dd 38 9e 9d 65 47 52 eb 10 71 db 50 |..Q..8..eGR..q.P| 00000010 b9 a8 01 42 6f 2e 32 |...Bo.2| 00000017

So use a memcpy instead of sprintf to have the correct value:

00000000 f4 91 51 f4 dd 00 9e 9d 65 47 52 eb 10 71 db 50 |..Q.....eGR..q.P| 00000010 b9 a8 01 42 |...B| 00000014

(the above have a hack to embed a zero inside and check it's returned correctly).

This is XSA-485 / CVE-2026-31786

Patch / fix

fixed in 1 distros 6 links 8

Linux Linux 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.26, 7.0.3, 7.1

debian ubuntu red hat opensuse almalinux rocky linux

linux Debian 12 6.1.170-1
linux Debian 13 6.12.85-1
linux Debian 14 7.0.3-1

debian advisories DEBIAN-CVE-2026-31786

linux Ubuntu 22.04 LTS 5.15.0-186.196
linux Ubuntu 24.04 LTS 6.8.0-136.136
linux Ubuntu 26.04 LTS 7.0.0-27.27
linux-aws Ubuntu 22.04 LTS 5.15.0-1112.119
linux-aws Ubuntu 24.04 LTS 6.8.0-1061.64
linux-aws Ubuntu 26.04 LTS 7.0.0-1008.8
linux-gcp Ubuntu 22.04 LTS 5.15.0-1112.122
linux-gcp Ubuntu 24.04 LTS 6.8.0-1064.72

ubuntu advisories UBUNTU-CVE-2026-31786

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 10.2 6.12.0-211.26.1.el10_2
rv RHEL 10.2 6.12.0-211.26.1.el10_2
perf RHEL 10.2 6.12.0-211.26.1.el10_2
rtla RHEL 10.2 6.12.0-211.26.1.el10_2
libperf RHEL 10.2 6.12.0-211.26.1.el10_2
kernel-rt RHEL 10.2 6.12.0-211.26.1.el10_2
kernel-64k RHEL 10.2 6.12.0-211.26.1.el10_2
kernel-core RHEL 10.2 6.12.0-211.26.1.el10_2

red hat advisories RHSA-2026:27288 RHSA-2026:26428 RHSA-2026:26427 RHSA-2026:24381

kernel-source openSUSE Tumbleweed 7.0.3-1.1

opensuse advisories openSUSE-SU-2026:10703-1

kernel AlmaLinux 10 6.12.0-211.26.1.el10_2
rv AlmaLinux 10 6.12.0-211.26.1.el10_2
perf AlmaLinux 10 6.12.0-211.26.1.el10_2
rtla AlmaLinux 10 6.12.0-211.26.1.el10_2
libperf AlmaLinux 10 6.12.0-211.26.1.el10_2
kernel-rt AlmaLinux 10 6.12.0-211.26.1.el10_2
kernel-64k AlmaLinux 10 6.12.0-211.26.1.el10_2
kernel-core AlmaLinux 10 6.12.0-211.26.1.el10_2

almalinux advisories ALSA-2026:27288 ALSA-2026:26427 ALSA-2026:26428 ALSA-2026:24381

kernel Rocky Linux 10 6.12.0-211.26.1.el10_2
kernel Rocky Linux 8 4.18.0-553.134.1.el8_10

rocky linux advisories RLSA-2026:27288 RLSA-2026:26427

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-31786 updated 2026-11-07 cvss 7.3

kernel: Buffer overflow in drivers/xen/sys-hypervisor.c

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
affected: workaround, no fix available
Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-687.13.1.el9_8, perf 5.14.0-687.13.1.el9_8, rtla 5.14.0-687.13.1.el9_8, python3-perf 5.14.0-687.13.1.el9_8, kernel-devel-matched 5.14.0-687.13.1.el9_8, kernel-64k-devel-matched 5.14.0-687.13.1.el9_8, +7 more
fixed: vendor fix RHSA-2026:24381
Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.26.1.el10_2, perf 6.12.0-211.26.1.el10_2, rtla 6.12.0-211.26.1.el10_2, python3-perf 6.12.0-211.26.1.el10_2, kernel-devel-matched 6.12.0-211.26.1.el10_2, kernel-64k-devel-matched 6.12.0-211.26.1.el10_2, +7 more
fixed: vendor fix RHSA-2026:27288
Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-553.134.1.el8_10, kernel 4.18.0-553.134.1.el8_10, bpftool 4.18.0-553.134.1.el8_10, kernel-core 4.18.0-553.134.1.el8_10, kernel-tools 4.18.0-553.134.1.el8_10, python3-perf 4.18.0-553.134.1.el8_10, +15 more
fixed: vendor fix RHSA-2026:26427
Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-687.13.1.el9_8, kernel-64k 5.14.0-687.13.1.el9_8, kernel-core 5.14.0-687.13.1.el9_8, kernel-tools 5.14.0-687.13.1.el9_8, kernel-modules 5.14.0-687.13.1.el9_8, kernel-64k-core 5.14.0-687.13.1.el9_8, +27 more
fixed: vendor fix RHSA-2026:24381
Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.26.1.el10_2, kernel-64k 6.12.0-211.26.1.el10_2, kernel-core 6.12.0-211.26.1.el10_2, kernel-tools 6.12.0-211.26.1.el10_2, kernel-modules 6.12.0-211.26.1.el10_2, kernel-64k-core 6.12.0-211.26.1.el10_2, +28 more
fixed: vendor fix RHSA-2026:27288

show 9 more

Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-687.13.1.el9_8, kernel-debuginfo-common-s390x 5.14.0-687.13.1.el9_8, kernel-debuginfo-common-x86_64 5.14.0-687.13.1.el9_8, kernel-debuginfo-common-aarch64 5.14.0-687.13.1.el9_8, kernel-debuginfo-common-ppc64le 5.14.0-687.13.1.el9_8
fixed: vendor fix RHSA-2026:24381
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.26.1.el10_2, kernel-debuginfo-common-s390x 6.12.0-211.26.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.26.1.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.26.1.el10_2, kernel-debuginfo-common-ppc64le 6.12.0-211.26.1.el10_2
fixed: vendor fix RHSA-2026:27288
Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-553.134.1.el8_10, kernel-debuginfo-common-aarch64 4.18.0-553.134.1.el8_10, kernel-debuginfo-common-ppc64le 4.18.0-553.134.1.el8_10
fixed: vendor fix RHSA-2026:26427
Red Hat Enterprise Linux NFV (v. 8) kernel-rt 4.18.0-553.134.1.rt7.475.el8_10, kernel-rt-kvm 4.18.0-553.134.1.rt7.475.el8_10, kernel-rt-core 4.18.0-553.134.1.rt7.475.el8_10, kernel-rt-modules 4.18.0-553.134.1.rt7.475.el8_10, kernel-rt-debug-kvm 4.18.0-553.134.1.rt7.475.el8_10, kernel-rt-debug-core 4.18.0-553.134.1.rt7.475.el8_10, +4 more
fixed: vendor fix RHSA-2026:26428
Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-687.13.1.el9_8, kernel-rt-64k 5.14.0-687.13.1.el9_8, kernel-rt-core 5.14.0-687.13.1.el9_8, kernel-rt-modules 5.14.0-687.13.1.el9_8, kernel-rt-64k-core 5.14.0-687.13.1.el9_8, kernel-rt-debug-core 5.14.0-687.13.1.el9_8, +14 more
fixed: vendor fix RHSA-2026:24381
Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.26.1.el10_2, kernel-rt-64k 6.12.0-211.26.1.el10_2, kernel-rt-core 6.12.0-211.26.1.el10_2, kernel-rt-modules 6.12.0-211.26.1.el10_2, kernel-rt-64k-core 6.12.0-211.26.1.el10_2, kernel-rt-debug-core 6.12.0-211.26.1.el10_2, +14 more
fixed: vendor fix RHSA-2026:27288
Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-687.13.1.el9_8, kernel-rt-core 5.14.0-687.13.1.el9_8, kernel-rt-modules 5.14.0-687.13.1.el9_8, kernel-rt-debug-core 5.14.0-687.13.1.el9_8, kernel-rt-modules-core 5.14.0-687.13.1.el9_8, kernel-rt-debug-modules 5.14.0-687.13.1.el9_8, +4 more
fixed: vendor fix RHSA-2026:24381
Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.26.1.el10_2, kernel-rt-core 6.12.0-211.26.1.el10_2, kernel-rt-modules 6.12.0-211.26.1.el10_2, kernel-rt-debug-core 6.12.0-211.26.1.el10_2, kernel-rt-modules-core 6.12.0-211.26.1.el10_2, kernel-rt-debug-modules 6.12.0-211.26.1.el10_2, +4 more
fixed: vendor fix RHSA-2026:27288
Red Hat Enterprise Linux RT (v. 8) kernel-rt 4.18.0-553.134.1.rt7.475.el8_10, kernel-rt-core 4.18.0-553.134.1.rt7.475.el8_10, kernel-rt-modules 4.18.0-553.134.1.rt7.475.el8_10, kernel-rt-debug-core 4.18.0-553.134.1.rt7.475.el8_10, kernel-rt-debug-modules 4.18.0-553.134.1.rt7.475.el8_10, kernel-rt-modules-extra 4.18.0-553.134.1.rt7.475.el8_10, +2 more
fixed: vendor fix RHSA-2026:26428

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 23 d ago (2026-10-16)

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-120 Buffer Copy without Checking Size of Input
CWE-787 Out-of-bounds Write

Technology feeds

Linux kernel rss critical rss

References

git.kernel.org /stable/c/e3af585e1728c917682b6a3de9a69b41fb9194d4
patch
git.kernel.org /stable/c/8288d031a01dbacfde3fc643f7be3d23504de64d
patch
git.kernel.org /stable/c/f458ba102da97fafca106327086fc95f3fc764cb
patch
git.kernel.org /stable/c/4b4defd2fce3f966c25adabf46644a85558f1169
patch
git.kernel.org /stable/c/5c5ff7c7bd15bb536f44b10b3fb5b8408f344d0a
patch
git.kernel.org /stable/c/d5f59216650c51e5e3fcb7517c825bc8047f60ef
patch
git.kernel.org /stable/c/52cecff98bda2c51eed1c6ce9d21c5d6268fb19d
patch
git.kernel.org /stable/c/27fdbab4221b375de54bf91919798d88520c6e28
patch
openwall.com /lists/oss-security/2026/04/28/12
mailing-list, third-party-advisory
xenbits.xen.org /xsa/advisory-485.html
mailing-list, third-party-advisory

Sources

CVE List CVE-2026-31786
NVD CVE-2026-31786

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary