CVE-2026-31521 - Vulnerability Details

- module: Fix kernel panic when a symbol st_shndx is out of bounds

Description

In the Linux kernel, the following vulnerability has been resolved:

module: Fix kernel panic when a symbol st_shndx is out of bounds

The module loader doesn't check for bounds of the ELF section index in
simplify_symbols():

for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
const char *name = info->strtab + sym[i].st_name;

switch (sym[i].st_shndx) {
case SHN_COMMON:

[...]

default:
/* Divert to percpu allocation if a percpu var. */
if (sym[i].st_shndx == info->index.pcpu)
secbase = (unsigned long)mod_percpu(mod);
else
/** HERE --> **/ secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
sym[i].st_value += secbase;
break;
}
}

A symbol with an out-of-bounds st_shndx value, for example 0xffff
(known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic:

BUG: unable to handle page fault for address: ...
RIP: 0010:simplify_symbols+0x2b2/0x480
...
Kernel panic - not syncing: Fatal exception

This can happen when module ELF is legitimately using SHN_XINDEX or
when it is corrupted.

Add a bounds check in simplify_symbols() to validate that st_shndx is
within the valid range before using it.

This issue was discovered due to a bug in llvm-objcopy, see relevant
discussion for details [1].

[1] https://lore.kernel.org/linux-modules/20251224005752.201911-1-ihor.solodrai@linux.dev/

Published: 2026-04-22

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Based on the description, the Linux kernel module loader fails to validate the ELF section index referenced by a symbol. When a module contains an out‑of‑bounds st_shndx value, the loader accesses memory outside the allocated array, resulting in a page‑fault and a kernel panic that stops the system.

Affected Systems

All Linux kernel releases are affected because the vulnerability resides in generic loader code shared across distributions; no specific vendor or product version is listed.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate‑severity denial of service. The EPSS score is < 1%, and the issue is not listed in the CISA KEV catalog, suggesting no widespread active exploitation. Based on the description, it is inferred that the attack vector requires the attacker to load a malicious or corrupted kernel module, which generally implies local privileged access or an environment that permits untrusted module loading.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 5d16f519b6eb1d071807e57efe0df2baa8d32ad6
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4bbdb0e48176fd281c2b9a211b110db6fd94e175
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 082f15d2887329e0f43fd3727e69365f5bfe5d2c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ec2b22a58073f80739013588af448ff6e2ab906f
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ef75dc1401d8e797ee51559a0dd0336c225e1776
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6ba6957c640f58dc8ef046981a045da43e47ea23
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< f9d69d5e7bde2295eb7488a56f094ac8f5383b92

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.15.203`	unaffected	≤ 5.15.*
`6.1.168`	unaffected	≤ 6.1.*
`6.6.131`	unaffected	≤ 6.6.*
`6.12.80`	unaffected	≤ 6.12.*
`6.18.21`	unaffected	≤ 6.18.*
`6.19.11`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:-::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc2::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc3::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc4::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5d16f519b6eb1d071807e57efe0df2baa8d32ad6)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4bbdb0e48176fd281c2b9a211b110db6fd94e175)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,082f15d2887329e0f43fd3727e69365f5bfe5d2c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ec2b22a58073f80739013588af448ff6e2ab906f)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ef75dc1401d8e797ee51559a0dd0336c225e1776)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6ba6957c640f58dc8ef046981a045da43e47ea23)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f9d69d5e7bde2295eb7488a56f094ac8f5383b92)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.168,6.2.0)`	unaffected	semver	—
`[6.6.131,6.7.0)`	unaffected	semver	—
`[6.12.80,6.13.0)`	unaffected	semver	—
`[6.18.21,6.19.0)`	unaffected	semver	—
`[6.19.11,6.20.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that includes the bounds‑check fix.
If an update cannot be applied immediately, restrict module loading by enforcing module signing or disabling module loading altogether.
Ensure that modules are built with a reliable toolchain that does not introduce out‑of‑bounds section indices, such as avoiding the faulty llvm-objcopy, and monitor kernel logs for panic events.

Generated by OpenCVE AI on April 29, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DSA	DSA-6238-1	linux security update
Debian DSA	DSA-6243-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00014.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/082f15d2887329e0f43fd3727e69365f5bfe5d2c
https://git.kernel.org/stable/c/4bbdb0e48176fd281c2b9a211b110db6fd94e175
https://git.kernel.org/stable/c/5d16f519b6eb1d071807e57efe0df2baa8d32ad6
https://git.kernel.org/stable/c/6ba6957c640f58dc8ef046981a045da43e47ea23
https://git.kernel.org/stable/c/ec2b22a58073f80739013588af448ff6e2ab906f
https://git.kernel.org/stable/c/ef75dc1401d8e797ee51559a0dd0336c225e1776
https://git.kernel.org/stable/c/f9d69d5e7bde2295eb7488a56f094ac8f5383b92
https://lore.kernel.org/linux-cve-announce/2026042212-CVE-2026-31521-b61e@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31521
https://www.cve.org/CVERecord?id=CVE-2026-31521

History

Wed, 29 Apr 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-127 CWE-20

Tue, 28 Apr 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
CPEs		cpe:2.3:o:linux:linux_kernel:2.6.12:-:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Mon, 27 Apr 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-127 CWE-20

Thu, 23 Apr 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1285
References		https://lore.kernel.org/linux-cve-announce/2026042212-CVE-2026-31521-b61e@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31521 https://www.cve.org/CVERecord?id=CVE-2026-31521
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Wed, 22 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: module: Fix kernel panic when a symbol st_shndx is out of bounds The module loader doesn't check for bounds of the ELF section index in simplify_symbols(): for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) { const char name = info->strtab + sym[i].st_name; switch (sym[i].st_shndx) { case SHN_COMMON: [...] default: / Divert to percpu allocation if a percpu var. / if (sym[i].st_shndx == info->index.pcpu) secbase = (unsigned long)mod_percpu(mod); else /* HERE --> **/ secbase = info->sechdrs[sym[i].st_shndx].sh_addr; sym[i].st_value += secbase; break; } } A symbol with an out-of-bounds st_shndx value, for example 0xffff (known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic: BUG: unable to handle page fault for address: ... RIP: 0010:simplify_symbols+0x2b2/0x480 ... Kernel panic - not syncing: Fatal exception This can happen when module ELF is legitimately using SHN_XINDEX or when it is corrupted. Add a bounds check in simplify_symbols() to validate that st_shndx is within the valid range before using it. This issue was discovered due to a bug in llvm-objcopy, see relevant discussion for details [1]. [1] https://lore.kernel.org/linux-modules/20251224005752.201911-1-ihor.solodrai@linux.dev/
Title		module: Fix kernel panic when a symbol st_shndx is out of bounds
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/082f15d2887329e0f43fd3727e69365f5bfe5d2c https://git.kernel.org/stable/c/4bbdb0e48176fd281c2b9a211b110db6fd94e175 https://git.kernel.org/stable/c/5d16f519b6eb1d071807e57efe0df2baa8d32ad6 https://git.kernel.org/stable/c/6ba6957c640f58dc8ef046981a045da43e47ea23 https://git.kernel.org/stable/c/ec2b22a58073f80739013588af448ff6e2ab906f https://git.kernel.org/stable/c/ef75dc1401d8e797ee51559a0dd0336c225e1776 https://git.kernel.org/stable/c/f9d69d5e7bde2295eb7488a56f094ac8f5383b92

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-22T13:54:36.211Z

Updated: 2026-05-11T22:10:24.268Z

Reserved: 2026-03-09T15:48:24.109Z

Link: CVE-2026-31521

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-04-22T14:16:51.930

Modified: 2026-04-28T18:26:58.433

Link: CVE-2026-31521

Redhat

Severity : Moderate

Publid Date: 2026-04-22T00:00:00Z

Links: CVE-2026-31521 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-29T03:30:15Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object