CVE-2026-31464: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31464 is an out-of-bounds read vulnerability in the Linux kernel's ibmvfc SCSI driver, specifically in the ibmvfc_discover_targets_done() function. A malicious or compromised VIO (Virtual I/O) server can return a crafted num_written value in a discover targets MAD response that exceeds max_targets, causing the kernel to access memory outside a DMA-coherent allocation and leak kernel memory contents back to the attacker. The vulnerability affects Linux kernel versions from 2.6.27 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0. It was published on April 22, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper validation of a server-supplied index value (CWE-1285) leading to an out-of-bounds read (CWE-125). In ibmvfc_discover_targets_done(), the num_written field from the VIO server's MAD response is stored directly into vhost->num_targets without being clamped to max_targets. This value is subsequently used as the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which is only allocated for max_targets entries — any index at or beyond max_targets reads kernel memory outside the DMA-coherent allocation. The out-of-bounds kernel memory is then embedded into Implicit Logout and PLOGI MADs sent back to the VIO server, completing the memory disclosure. The fix clamps num_written to max_targets before storing it (GitHub Advisory).

Successful exploitation allows an adjacent-network attacker controlling a malicious or compromised VIO server to read arbitrary kernel memory contents, resulting in high confidentiality impact. The leaked kernel memory — returned via Implicit Logout and PLOGI MADs — could expose sensitive data such as cryptographic keys, credentials, or other process memory. Additionally, the vulnerability carries high availability impact per its CVSS score, suggesting potential for system instability or crash conditions alongside the memory disclosure (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a low probability of near-term exploitation. Exploitation requires adjacent network access and control of a VIO server, limiting the attack surface to IBM Power virtualization environments.

Upgrade the Linux kernel to a patched stable version: 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, or 7.0 (stable). The fix clamps the num_written value to max_targets before storing it in vhost->num_targets, preventing out-of-bounds memory access. As a defense-in-depth measure, ensure VIO servers and virtualization infrastructure are sourced from trusted vendors and are not compromised. SUSE has also released a kernel security update (SUSE-SU-2026:22048-1) addressing this issue (GitHub Advisory, SUSE Advisory).

Red Hat tracked the vulnerability via Bugzilla and assigned a CVSS v3.1 score of 8.1 (High), and SUSE issued a kernel security update (SUSE-SU-2026:22048-1) addressing the flaw (Red Hat Bugzilla, SUSE Advisory). The Yocto Project security mailing list also flagged the CVE for embedded Linux maintainers. No notable independent researcher commentary or significant social media discussion has been observed.