CVE-2026-31401: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31401 is a buffer overflow vulnerability in the Linux kernel's HID-BPF subsystem, specifically within the hid_hw_request function. The flaw arises because the return value from dispatch_hid_bpf_raw_requests() is treated as always valid without bounds checking, allowing an arbitrarily large value to cause an out-of-bounds write. It affects Linux kernel versions 6.11 through 6.12.x (before 6.12.78), 6.13 through 6.18.x (before 6.18.20), 6.19.x (before 6.19.10), and 7.0 release candidates (rc1–rc4). Disclosed on April 3, 2026, it carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory).

The root cause is classified as CWE-787 (Out-of-bounds Write). When the HID-BPF subsystem processes hardware requests via hid_hw_request, it calls dispatch_hid_bpf_raw_requests(), which invokes user-controlled struct_ops callbacks. The return value of this call is used without validation, meaning a malicious or buggy BPF program can return an arbitrarily large integer that is subsequently used in a buffer operation, causing a write beyond the intended buffer boundary. Exploitation requires local access with low privileges (e.g., the ability to load BPF programs), and no user interaction is needed (GitHub Advisory).

Successful exploitation allows a low-privileged local attacker to achieve high impact across all three security dimensions: unauthorized memory reads (confidentiality), arbitrary memory writes (integrity), and kernel crashes (availability). The out-of-bounds write could be leveraged for local privilege escalation, potentially granting an attacker full kernel-level control of the affected system. Lateral movement within a compromised host or container escape scenarios are plausible follow-on consequences (GitHub Advisory).

Upgrade the Linux kernel to a patched version: 6.12.78 or later for the 6.11–6.12 branch, 6.18.20 or later for the 6.13–6.18 branch, 6.19.10 or later for the 6.19 branch, or 7.0-rc5 or later for the 7.0 release candidate series. Patches are available in the upstream kernel stable tree (GitHub Advisory). As a temporary workaround on systems that cannot be immediately updated, restrict or disable access to HID-BPF functionality by limiting BPF program loading privileges (e.g., setting kernel.unprivileged_bpf_disabled=1 via sysctl). Amazon Linux 2023 users should apply ALAS2023-2026-1594.

The vulnerability was announced via the Linux kernel CVE mailing list shortly after disclosure and picked up by automated CVE tracking services including VulDB, CVEFeed, and Bluesky CVE bots. The Yocto Project security mailing list also discussed the issue in the context of embedded Linux distributions. No notable independent researcher commentary or significant media coverage has been identified beyond routine CVE aggregation.