CVE-2026-31747

The vulnerability is located in the comedi me4000 driver of the Linux kernel. During the firmware download process, the driver reads a four‑byte length field from the beginning of the firmware file and then copies that many bytes starting at offset 16 into a buffer allocated for the firmware data. Because the code does not verify that the firmware file is large enough to contain the entire length field and data stream, a crafted firmware image can cause the buffer to be overrun. The CVE description states that this can lead to kernel memory corruption, potentially resulting in a crash or other undefined kernel behavior. No explicit impact such as privilege escalation is mentioned in the description.

All Linux kernel versions that include the comedi me4000 driver and that have not yet integrated the fix are affected. The patch was applied in commit ac584af59945, so any kernel build that contains this commit or a later version is considered fixed.

The CVSS score is 7.8, and the EPSS score is less than 1%, indicating a high potential severity but low current exploitation likelihood. The vulnerability is not listed in CISA's KEV catalog, indicating that there is no known widespread exploitation. Based on the nature of the flaw—a kernel buffer overrun—security analysts generally consider it a high‑severity issue. The likely attack vector is a local attacker who can supply a malicious firmware image to a me4000 device; this inference is based on the fact that the vulnerability is triggered during firmware loading.