CVE-2026-31619: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31619 is an improper index validation vulnerability in the Linux kernel's ALSA fireworks (ALSA: fireworks) driver that can lead to an out-of-bounds memory read and potential denial of service. The vulnerability was published on April 24, 2026, and affects Linux kernel versions from 3.16 through multiple stable branches, with fixed versions including 6.6.136, 6.12.83, 6.18.24, 6.19.14, and 7.0.1. The root cause is that the status field in an EFW (Echo Fireworks) device response — a 32-bit value supplied by the firewire device — is used directly as an index into the efr_status_names[] array without bounds checking. It carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, Feedly).

The vulnerability is classified as CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input). The efr_status_names[] array in the ALSA fireworks driver contains only 17 entries, but the status field from an EFW response is a raw 32-bit device-supplied value with no bounds enforcement before it is used as an array index for a %s string lookup. A particularly dangerous case is EFR_STATUS_INCOMPLETE (value 0x80000000), which is far outside the valid array range and would cause the kernel to access an arbitrary memory location. The fix adds proper bounds checking against the array size and substitutes "unknown" for any unrecognized status value (Github Advisory, Feedly).

A malicious or malfunctioning firewire device can supply arbitrary 32-bit status values that trigger out-of-bounds memory reads in the kernel, potentially leaking sensitive kernel memory contents (information disclosure) or causing a kernel crash (denial of service). The vulnerability requires local physical access to connect a malicious firewire device, but once connected, the device can be manipulated by a low-privileged user. There is no impact on data integrity or confidentiality beyond potential kernel memory leakage (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.014% (3rd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires physical access to connect a specially crafted or malfunctioning firewire device to the target system (Github Advisory, Feedly).

Update the Linux kernel to a patched version: 6.6.136 or later (for 6.6.x branch, starting from 3.16), 6.12.83 or later (for 6.7–6.12), 6.18.24 or later (for 6.13–6.18), 6.19.14 or later (for 6.19.x), or 7.0.1 or later (for 7.0+). Kernel patches are available at git.kernel.org (commits: 07704bbf, 67cfd140, 682d8acc, cc624b3d, e103f98f, f856f4b6). As a workaround, restrict physical firewire device connections to trusted hardware only, or disable firewire (IEEE 1394) kernel support entirely if it is not required (Github Advisory, Feedly).