CVE-2026-31395: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31395 is an out-of-bounds access vulnerability in the Linux kernel's bnxt_en driver, specifically in the DBG_BUF_PRODUCER async event handler within bnxt_async_event_process(). The vulnerability arises because a firmware-supplied 16-bit type field is used directly as an array index into bp->bs_trace[] without bounds validation, allowing a malicious or compromised Broadcom NIC to trigger kernel heap memory corruption. It affects Linux kernel versions 6.13 through 6.18.20 and 6.19 through 6.19.10, as well as 7.0-rc1 through 7.0-rc4. It was published on April 3, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-787 (Out-of-bounds Write) and CWE-125 (Out-of-bounds Read). The ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER handler in bnxt_async_event_process() extracts a 16-bit type field from DMA-mapped completion ring memory — memory that the NIC writes directly to host RAM — and uses it without validation as an index into the bp->bs_trace[] array. Since the type field can range from 0 to 65535 but the array only covers trace types 0x0 through 0xc, a malicious or compromised NIC can supply an out-of-range value, causing bnxt_bs_trace_check_wrap() to dereference bs_trace->magic_byte and write to bs_trace->last_offset and bs_trace->wrapped at arbitrary kernel heap offsets. The fix adds a bounds check and defines BNXT_TRACE_MAX as DBG_LOG_BUFFER_FLUSH_REQ_TYPE_ERR_QPC_TRACE + 1 (Red Hat Bugzilla, Github Advisory).

Successful exploitation can result in kernel heap memory corruption, denial of service via kernel crash, or potential privilege escalation if the memory corruption can be leveraged to overwrite sensitive kernel data structures. The confidentiality impact is high, as out-of-bounds reads may expose kernel heap contents; availability is also high due to the risk of kernel panic. While integrity is not directly impacted in the CVSS scoring, the write primitive to arbitrary heap offsets creates conditions that could be chained for further exploitation in targeted attack scenarios (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Github Advisory). The EPSS score is approximately 0.017–0.021%, placing it in a low percentile for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires either a physically compromised or maliciously firmware-flashed Broadcom NIC, making it primarily a hardware supply-chain or insider threat scenario rather than a remotely exploitable weakness.

Apply the upstream kernel patches available for the affected stable branches: commit 19aa416eed9e (for the 6.19.x branch), 64dcbde7f8f8 (for the 6.18.x branch), and b7c7a275447c (for an additional stable branch) (Github Advisory). Distributions including SUSE have released security updates (e.g., SUSE-SU-2026:21834-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1). As an interim measure, restrict access to network device firmware update capabilities and ensure Broadcom NICs are sourced from trusted vendors with verified supply chains. Monitor kernel logs for unexpected async event processing errors or system crashes that may indicate exploitation attempts.