CVE-2026-31491

MediumCVSS 5.5/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Harden depth calculation functions

An issue was exposed where OS can pass in U32_MAX for SQ/RQ/SRQ size. This can cause integer overflow and truncation of SQ/RQ/SRQ depth returning a success when it should have failed.

Harden the functions to do all depth calculations and boundary checking in u64 sizes.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-190

Affected software

VendorProductVersions
LinuxLinux>= 563e1feb5f6ed579acb55850f1bbb831aecf645a, < 3f08351de5ca4f2f724b86ad252fbc21289467e1; >= 563e1feb5f6ed579acb55850f1bbb831aecf645a, < cbd852f5700eb3f64392452faf693ac45cae8281; >= 563e1feb5f6ed579acb55850f1bbb831aecf645a, < e37afcb56ae070477741fe2d6e61fc0c542cce2d
LinuxLinux6.18

References

Timeline

Published
Apr 22, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-314925.5In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Initialize free_qp completion before using it In irdma_creCVE-2026-314937.8In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix use of completion ctx after free On admin queue completiCVE-2026-314947.8In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats There's a potential CVE-2026-314955.5In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use netlink policy range checks Replace manual rCVE-2026-314965.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: skip expectations in other netns via prCVE-2026-314975.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: clamp SCO altsetting table indices btusb_work() mapsCVE-2026-314985.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop l2caCVE-2026-314995.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() l2cap_conn_del() caCVE-2026-31508.8A security vulnerability has been detected in itsourcecode College Management System 1.0. This affects an unknown part of the file /admin/diCVE-2026-315007.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lockCVE-2026-315019.8In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX pathCVE-2026-315027.8In the Linux kernel, the following vulnerability has been resolved: team: fix header_ops type confusion with non-Ethernet ports Similar to
CVE-2026-31491: Medium severity, CVSS 5.5 | Vulnix