CVE-2026-31786: Buffer overflow in drivers/xen/sys-hypervisor.c
Vulnerability summary
CVE-2026-31786 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in linux. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.4% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 2Timeline
- 30-04-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string. The first causes a buffer overflow as sprintf in buildid_show will read and copy till it finds a NUL. 00000000 f4 91 51 f4 dd 38 9e 9d 65 47 52 eb 10 71 db 50 |..Q..8..eGR..q.P| 00000010 b9 a8 01 42 6f 2e 32 |...Bo.2| 00000017 So use a memcpy instead of sprintf to have the correct value: 00000000 f4 91 51 f4 dd 00 9e 9d 65 47 52 eb 10 71 db 50 |..Q.....eGR..q.P| 00000010 b9 a8 01 42 |...B| 00000014 (the above have a hack to embed a zero inside and check it's returned correctly). This is XSA-485 / CVE-2026-31786
CVSS metrics
6 scores · 6 sources · 1 version- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
Decrease -0.01 pp
From 0.21% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
- CWE-120Buffer Copy without Checking Size of InputThe product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu169 products
- linuxAll versions (No fix recorded) | < 5.15.0-186.196 | < 6.8.0-136.136 | < 7.0.0-27.27
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1112.119 | < 6.8.0-1061.64 | < 7.0.0-1008.8
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Chainguard11 products
- linux-aws-6.12< 6.12.85-r2
- linux-aws-6.18< 6.18.31-r0
- linux-azure-6.12< 6.12.85-r2
- linux-azure-6.18< 6.18.24-r1 | < 6.18.31-r0
- linux-gcp-6.12< 6.12.89-r0
Linux2 products
- linux≥ 84b7625728ea311ea35bdaa0eded53c1c56baeaa, < e3af585e1728c917682b6a3de9a69b41fb9194d4 | ≥ 84b7625728ea311ea35bdaa0eded53c1c56baeaa, < 8288d031a01dbacfde3fc643f7be3d23504de64d | ≥ 84b7625728ea311ea35bdaa0eded53c1c56baeaa, < f458ba102da97fafca106327086fc95f3fc764cb | ≥ 84b7625728ea311ea35bdaa0eded53c1c56baeaa, < 4b4defd2fce3f966c25adabf46644a85558f1169 | ≥ 84b7625728ea311ea35bdaa0eded53c1c56baeaa, < 5c5ff7c7bd15bb536f44b10b3fb5b8408f344d0a | ≥ 84b7625728ea311ea35bdaa0eded53c1c56baeaa, < d5f59216650c51e5e3fcb7517c825bc8047f60ef | ≥ 84b7625728ea311ea35bdaa0eded53c1c56baeaa, < 52cecff98bda2c51eed1c6ce9d21c5d6268fb19d | ≥ 84b7625728ea311ea35bdaa0eded53c1c56baeaa, < 27fdbab4221b375de54bf91919798d88520c6e28 | 4.13
- linux_kernel≥ 4.13, < 5.10.254 | ≥ 5.11, < 5.15.204 | ≥ 5.16, < 6.1.170 | ≥ 6.2, < 6.6.137 | ≥ 6.7, < 6.12.85 | ≥ 6.13, < 6.18.26 | ≥ 6.19, < 7.0.3 | 7.1:rc1 | 7.1:rc2
Alpine1 product
- xenAll versions (No fix recorded)
Debian1 product
- linux< 6.1.170-1 | < 6.12.85-1 | < 7.0.3-1
5 vendors · 184 products
