High 8.1Published Apr 22, 2026

CVE-2026-31464scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()

Updated under an hour ago (Oct 26, 2026, 9:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() A malicious or compromised VIO server can return a num_written value in the discover targets MAD response that exceeds max_targets. This value is stored directly in vhost->num_targets without validation, and is then used as the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which is only allocated for max_targets entries. Indices at or beyond max_targets access kernel memory outside the DMA-coherent allocation. The out-of-bounds data is subsequently embedded in Implicit Logout and PLOGI MADs that are sent back to the VIO server, leaking kernel memory. Fix by clamping num_written to max_targets before storing it.

CVSS: 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 072b91f9c6510d0ec4a49d07dbc318760c7da7b3 before d842348f8a00d5b1d7358f207eb34ffcf5b16df3; from 072b91f9c6510d0ec4a49d07dbc318760c7da7b3 before a007246cb6c9ebdc93dafbf63cc2d43d98f402cc; from 072b91f9c6510d0ec4a49d07dbc318760c7da7b3 before 394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89; 072b91f9c6510d0ec4a49d07dbc318760c7da7b3 builds before 4ed727e35b0ab17d3eeeb1e8023768396e2be161; from 072b91f9c6510d0ec4a49d07dbc318760c7da7b3 before d1466bf991b2343cf2ba8336e440c8faf3cbb780; from 072b91f9c6510d0ec4a49d07dbc318760c7da7b3 before 786f10b1966e485046839f992e89f2c18cbd1983; from 072b91f9c6510d0ec4a49d07dbc318760c7da7b3 before bae4df0a643fa7f84663473aa3082a9c2ed139db; 072b91f9c6510d0ec4a49d07dbc318760c7da7b3 builds before 61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.27 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.168; from 6.2 before 6.6.131; from 6.7 before 6.12.80; from 6.13 before 6.18.21; from 6.19 before 6.19.11; 7.0; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/d842348f8a00d5b1d7358f207eb34ffcf5b16df3	patch
https://git.kernel.org/stable/c/a007246cb6c9ebdc93dafbf63cc2d43d98f402cc	patch
https://git.kernel.org/stable/c/394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89	patch
https://git.kernel.org/stable/c/4ed727e35b0ab17d3eeeb1e8023768396e2be161	patch
https://git.kernel.org/stable/c/d1466bf991b2343cf2ba8336e440c8faf3cbb780	patch
https://git.kernel.org/stable/c/786f10b1966e485046839f992e89f2c18cbd1983	patch
https://git.kernel.org/stable/c/bae4df0a643fa7f84663473aa3082a9c2ed139db	patch
https://git.kernel.org/stable/c/61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.