CVE-2026-31521 - Vulnerability Details

- module: Fix kernel panic when a symbol st_shndx is out of bounds

Description

In the Linux kernel, the following vulnerability has been resolved:

module: Fix kernel panic when a symbol st_shndx is out of bounds

The module loader doesn't check for bounds of the ELF section index in
simplify_symbols():

for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
const char *name = info->strtab + sym[i].st_name;

switch (sym[i].st_shndx) {
case SHN_COMMON:

[...]

default:
/* Divert to percpu allocation if a percpu var. */
if (sym[i].st_shndx == info->index.pcpu)
secbase = (unsigned long)mod_percpu(mod);
else
/** HERE --> **/ secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
sym[i].st_value += secbase;
break;
}
}

A symbol with an out-of-bounds st_shndx value, for example 0xffff
(known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic:

BUG: unable to handle page fault for address: ...
RIP: 0010:simplify_symbols+0x2b2/0x480
...
Kernel panic - not syncing: Fatal exception

This can happen when module ELF is legitimately using SHN_XINDEX or
when it is corrupted.

Add a bounds check in simplify_symbols() to validate that st_shndx is
within the valid range before using it.

This issue was discovered due to a bug in llvm-objcopy, see relevant
discussion for details [1].

[1] https://lore.kernel.org/linux-modules/20251224005752.201911-1-ihor.solodrai@linux.dev/

Published: 2026-04-22

Score: 7.0 High

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 5d16f519b6eb1d071807e57efe0df2baa8d32ad6
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4bbdb0e48176fd281c2b9a211b110db6fd94e175
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 082f15d2887329e0f43fd3727e69365f5bfe5d2c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ec2b22a58073f80739013588af448ff6e2ab906f
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ef75dc1401d8e797ee51559a0dd0336c225e1776
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6ba6957c640f58dc8ef046981a045da43e47ea23
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< f9d69d5e7bde2295eb7488a56f094ac8f5383b92

Linux

affected

Version	Status	Constraints
`5.15.203`	unaffected	≤ 5.15.*
`6.1.168`	unaffected	≤ 6.1.*
`6.6.131`	unaffected	≤ 6.6.*
`6.12.80`	unaffected	≤ 6.12.*
`6.18.21`	unaffected	≤ 6.18.*
`6.19.11`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5d16f519b6eb1d071807e57efe0df2baa8d32ad6)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4bbdb0e48176fd281c2b9a211b110db6fd94e175)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,082f15d2887329e0f43fd3727e69365f5bfe5d2c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ec2b22a58073f80739013588af448ff6e2ab906f)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ef75dc1401d8e797ee51559a0dd0336c225e1776)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6ba6957c640f58dc8ef046981a045da43e47ea23)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f9d69d5e7bde2295eb7488a56f094ac8f5383b92)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.168,6.2.0)`	unaffected	semver	—
`[6.6.131,6.7.0)`	unaffected	semver	—
`[6.12.80,6.13.0)`	unaffected	semver	—
`[6.18.21,6.19.0)`	unaffected	semver	—
`[6.19.11,6.20.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/082f15d2887329e0f43fd3727e69365f5bfe5d2c
https://git.kernel.org/stable/c/4bbdb0e48176fd281c2b9a211b110db6fd94e175
https://git.kernel.org/stable/c/5d16f519b6eb1d071807e57efe0df2baa8d32ad6
https://git.kernel.org/stable/c/6ba6957c640f58dc8ef046981a045da43e47ea23
https://git.kernel.org/stable/c/ec2b22a58073f80739013588af448ff6e2ab906f
https://git.kernel.org/stable/c/ef75dc1401d8e797ee51559a0dd0336c225e1776
https://git.kernel.org/stable/c/f9d69d5e7bde2295eb7488a56f094ac8f5383b92
https://lore.kernel.org/linux-cve-announce/2026042212-CVE-2026-31521-b61e@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31521
https://www.cve.org/CVERecord?id=CVE-2026-31521

History

Thu, 23 Apr 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1285
References		https://lore.kernel.org/linux-cve-announce/2026042212-CVE-2026-31521-b61e@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31521 https://www.cve.org/CVERecord?id=CVE-2026-31521
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Wed, 22 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: module: Fix kernel panic when a symbol st_shndx is out of bounds The module loader doesn't check for bounds of the ELF section index in simplify_symbols(): for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) { const char name = info->strtab + sym[i].st_name; switch (sym[i].st_shndx) { case SHN_COMMON: [...] default: / Divert to percpu allocation if a percpu var. / if (sym[i].st_shndx == info->index.pcpu) secbase = (unsigned long)mod_percpu(mod); else /* HERE --> **/ secbase = info->sechdrs[sym[i].st_shndx].sh_addr; sym[i].st_value += secbase; break; } } A symbol with an out-of-bounds st_shndx value, for example 0xffff (known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic: BUG: unable to handle page fault for address: ... RIP: 0010:simplify_symbols+0x2b2/0x480 ... Kernel panic - not syncing: Fatal exception This can happen when module ELF is legitimately using SHN_XINDEX or when it is corrupted. Add a bounds check in simplify_symbols() to validate that st_shndx is within the valid range before using it. This issue was discovered due to a bug in llvm-objcopy, see relevant discussion for details [1]. [1] https://lore.kernel.org/linux-modules/20251224005752.201911-1-ihor.solodrai@linux.dev/
Title		module: Fix kernel panic when a symbol st_shndx is out of bounds
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/082f15d2887329e0f43fd3727e69365f5bfe5d2c https://git.kernel.org/stable/c/4bbdb0e48176fd281c2b9a211b110db6fd94e175 https://git.kernel.org/stable/c/5d16f519b6eb1d071807e57efe0df2baa8d32ad6 https://git.kernel.org/stable/c/6ba6957c640f58dc8ef046981a045da43e47ea23 https://git.kernel.org/stable/c/ec2b22a58073f80739013588af448ff6e2ab906f https://git.kernel.org/stable/c/ef75dc1401d8e797ee51559a0dd0336c225e1776 https://git.kernel.org/stable/c/f9d69d5e7bde2295eb7488a56f094ac8f5383b92

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-22T13:54:36.211Z

Updated: 2026-04-22T13:54:36.211Z

Reserved: 2026-03-09T15:48:24.109Z

Link: CVE-2026-31521

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-04-22T14:16:51.930

Modified: 2026-04-22T14:16:51.930

Link: CVE-2026-31521

Redhat

Severity : Moderate

Publid Date: 2026-04-22T00:00:00Z

Links: CVE-2026-31521 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-22T18:45:23Z

Weaknesses

CWE-1285

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object