Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-31649 is a critical-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Linux Linux Kernel. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique LSA Secrets (T1003.004); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-31649 is an integer underflow vulnerability in the Linux kernel's stmmac network driver, specifically within the jumbo_frm() function operating in chain mode. The issue arises when processing jumbo frames where the linear portion of an skb (nopaged_len) is small (≤ bmax, typically BUF_SIZE_8KiB or BUF_SIZE_2KiB), but the total skb->len exceeds bmax due to page fragments. This leads to an unconditional computation of len = nopaged_len - bmax, causing unsigned integer wraparound and a massive len value, triggering excessive iterations in a while (len != 0) loop.
Any unauthenticated network attacker can exploit this remotely with low complexity, as indicated by the CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). By sending a crafted packet that meets the jumbo frame criteria but has a minimal linear head and large fragments, the attacker induces the driver to invoke dma_map_single() on pointers far beyond the skb buffer (e.g., skb->data + bmax * i for hundreds of thousands of i values). On IOMMU-less SoCs—common deployments for stmmac—this exposes arbitrary kernel memory to the DMA engine, enabling kernel memory disclosure and potential hardware-induced memory corruption (CWE-190).
The provided kernel stable commit references detail the fix: introduce a buf_len variable clamped to min(nopaged_len, bmax), ensuring len = nopaged_len - buf_len is always safe (zero or positive). This skips the problematic loop when the linear portion fits a single descriptor, allowing the subsequent fragment loop in stmmac_xmit() to handle pages correctly. Security practitioners should apply these backported patches to affected Linux kernel versions using the stable repository updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25542
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix integer underflow in chain mode The jumbo_frm() chain-mode implementation unconditionally computes len = nopaged_len - bmax; where nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is BUF_SIZE_8KiB…
more
or BUF_SIZE_2KiB. However, the caller stmmac_xmit() decides to invoke jumbo_frm() based on skb->len (total length including page fragments): is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc); When a packet has a small linear portion (nopaged_len <= bmax) but a large total length due to page fragments (skb->len > bmax), the subtraction wraps as an unsigned integer, producing a huge len value (~0xFFFFxxxx). This causes the while (len != 0) loop to execute hundreds of thousands of iterations, passing skb->data + bmax * i pointers far beyond the skb buffer to dma_map_single(). On IOMMU-less SoCs (the typical deployment for stmmac), this maps arbitrary kernel memory to the DMA engine, constituting a kernel memory disclosure and potential memory corruption from hardware. Fix this by introducing a buf_len local variable clamped to min(nopaged_len, bmax). Computing len = nopaged_len - buf_len is then always safe: it is zero when the linear portion fits within a single descriptor, causing the while (len != 0) loop to be skipped naturally, and the fragment loop in stmmac_xmit() handles page fragments afterward.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.2.6
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (static analysis, fuzzing, unit tests) directly finds integer overflow defects before deployment.
Secure engineering principles require use of safe arithmetic constructs or language features that structurally eliminate integer overflow during calculation.
Input validation enforces bounds on values before arithmetic, stopping the conditions that trigger overflow or wraparound.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require use of safe arithmetic, bounds checks, and testing that prevent integer overflows.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.