net: macb: use the current queue number for stats
Summary
| CVE | CVE-2026-31494 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-04-22 14:16:47 UTC |
|---|
| Updated | 2026-04-22 14:16:47 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
net: macb: use the current queue number for stats
There's a potential mismatch between the memory reserved for statistics
and the amount of memory written.
gem_get_sset_count() correctly computes the number of stats based on the
active queues, whereas gem_get_ethtool_stats() indiscriminately copies
data using the maximum number of queues, and in the case the number of
active queues is less than MACB_MAX_QUEUES, this results in a OOB write
as observed in the KASAN splat.
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78
[macb]
Write of size 760 at addr ffff80008080b000 by task ethtool/1027
CPU: [...]
Tainted: [E]=UNSIGNED_MODULE
Hardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025
Call trace:
show_stack+0x20/0x38 (C)
dump_stack_lvl+0x80/0xf8
print_report+0x384/0x5e0
kasan_report+0xa0/0xf0
kasan_check_range+0xe8/0x190
__asan_memcpy+0x54/0x98
gem_get_ethtool_stats+0x54/0x78 [macb
926c13f3af83b0c6fe64badb21ec87d5e93fcf65]
dev_ethtool+0x1220/0x38c0
dev_ioctl+0x4ac/0xca8
sock_do_ioctl+0x170/0x1d8
sock_ioctl+0x484/0x5d8
__arm64_sys_ioctl+0x12c/0x1b8
invoke_syscall+0xd4/0x258
el0_svc_common.constprop.0+0xb4/0x240
do_el0_svc+0x48/0x68
el0_svc+0x40/0xf8
el0t_64_sync_handler+0xa0/0xe8
el0t_64_sync+0x1b0/0x1b8
The buggy address belongs to a 1-page vmalloc region starting at
0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000
index:0xffff00000a333000 pfn:0xa333
flags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff)
raw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
^
ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================
Fix it by making sure the copied size only considers the active number of
queues. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd 9738be665544281aa624842812c2fbfed6f88226 git |
Not specified |
| CNA |
Linux |
Linux |
affected 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd 240c5302eed83e34e98db18f6795ee5f40814024 git |
Not specified |
| CNA |
Linux |
Linux |
affected 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd 9596759a84e1dbf2670518d85e969208960041f9 git |
Not specified |
| CNA |
Linux |
Linux |
affected 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd 95246341945163ad9a250a87ca5bd1c1252777ae git |
Not specified |
| CNA |
Linux |
Linux |
affected 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd 9d74d10e4e26672e139a8bcf8bf95957bf2d160f git |
Not specified |
| CNA |
Linux |
Linux |
affected 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd 7ff87da099210856cbfe2f2f7f52ddfa57af4f0c git |
Not specified |
| CNA |
Linux |
Linux |
affected 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd e182fe273cdf5a8931592228196ef514ffac392b git |
Not specified |
| CNA |
Linux |
Linux |
affected 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd 72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5 git |
Not specified |
| CNA |
Linux |
Linux |
affected 4.16 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 4.16 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.10.253 5.10.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.15.203 5.15.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.1.168 6.1.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.131 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.80 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.21 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.19.11 6.19.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.0 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/95246341945163ad9a250a87ca5bd1c1252777ae |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/9d74d10e4e26672e139a8bcf8bf95957bf2d160f |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/9596759a84e1dbf2670518d85e969208960041f9 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/e182fe273cdf5a8931592228196ef514ffac392b |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/7ff87da099210856cbfe2f2f7f52ddfa57af4f0c |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/9738be665544281aa624842812c2fbfed6f88226 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/240c5302eed83e34e98db18f6795ee5f40814024 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.
