CVE-2026-31405 media: dvb-net: fix OOB access in ULE extension header tables
An out-of-bounds read in the Linux kernel DVB network driver allows attackers to trigger memory corruption or execute arbitrary code via crafted network packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31405?
CVE-2026-31405 is a critical memory corruption vulnerability in Linux kernel, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: dvb-net: fix OOB access in ULE extension header tables
The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables in handle_one_ule_extension() are declared with 255 elements (valid indices 0-254), but the index htype is derived from network-controlled data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When htype equals 255, an out-of-bounds read occurs on the function pointer table, and the OOB value may be called as a function pointer.
Add a bounds check on htype against the array size before either table is accessed. Out-of-range values now cause the SNDU to be discarded.
Weakness: CWE-125
Which versions are affected by CVE-2026-31405?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31405?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-31405 being exploited?
There is no known exploitation of CVE-2026-31405 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31405, DEBIAN-CVE-2026-31405, GHSA-qqxp-95qg-gqxr, ROOT-OS-DEBIAN-11-CVE-2026-31405, ROOT-OS-DEBIAN-12-CVE-2026-31405, ROOT-OS-DEBIAN-13-CVE-2026-31405 and 3 more.