CVE-2026-31405
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
In the Linux kernel dvb-net driver, an out-of-bounds read vulnerability exists in ULE extension header tables. The htype index derived from network data can be 255, causing an out-of-bounds read on a 255-element array, and the read value may be called as a function pointer.
Risk Assessment
An attacker can remotely trigger arbitrary code execution in kernel context, leading to full system compromise.
Recommendation
Apply the Linux kernel patch that adds bounds checking on the htype index before accessing the tables.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables in handle_one_ule_extension() are declared with 255 elements (valid indices 0-254), but the index htype is derived from network-controlled data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When htype equals 255, an out-of-bounds read occurs on the function pointer table, and the OOB value may be called as a function pointer. Add a bounds check on htype against the array size before either table is accessed. Out-of-range values now cause the SNDU to be discarded.