HOMEVULNERABILITIESCVE-2026-31786
HIGH

CVE-2026-31786

Published: April 30, 2026· Updated: May 6, 2026

7.8
CVSS v3.1
EPSS:0.01%probability of exploitation in 30 daysPercentile:1.5th

Official Description

In the Linux kernel, the following vulnerability has been resolved:

Buffer overflow in drivers/xen/sys-hypervisor.c

The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is

neither NUL terminated nor a string.

The first causes a buffer overflow as sprintf in buildid_show will

read and copy till it finds a NUL.

00000000 f4 91 51 f4 dd 38 9e 9d 65 47 52 eb 10 71 db 50 |..Q..8..eGR..q.P|

00000010 b9 a8 01 42 6f 2e 32 |...Bo.2|

00000017

So use a memcpy instead of sprintf to have the correct value:

00000000 f4 91 51 f4 dd 00 9e 9d 65 47 52 eb 10 71 db 50 |..Q.....eGR..q.P|

00000010 b9 a8 01 42 |...B|

00000014

(the above have a hack to embed a zero inside and check it's

returned correctly).

This is XSA-485 / CVE-2026-31786

NVD Source

Technical Analysis

CVE-2026-31786 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorLocal
Attack ComplexityLow
Privileges Req.Low
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

Linux1 product
linux kernel
Source: NVD CPE · 2 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://git.kernel.org/stable/c/27fdbab4221b375de54bf91919798d88520c6e28
PATCHhttps://git.kernel.org/stable/c/4b4defd2fce3f966c25adabf46644a85558f1169
PATCHhttps://git.kernel.org/stable/c/52cecff98bda2c51eed1c6ce9d21c5d6268fb19d
PATCHhttps://git.kernel.org/stable/c/5c5ff7c7bd15bb536f44b10b3fb5b8408f344d0a
PATCHhttps://git.kernel.org/stable/c/8288d031a01dbacfde3fc643f7be3d23504de64d
PATCHhttps://git.kernel.org/stable/c/d5f59216650c51e5e3fcb7517c825bc8047f60ef
PATCHhttps://git.kernel.org/stable/c/e3af585e1728c917682b6a3de9a69b41fb9194d4
PATCHhttps://git.kernel.org/stable/c/f458ba102da97fafca106327086fc95f3fc764cb
ADVISORYhttp://www.openwall.com/lists/oss-security/2026/04/28/12
ADVISORYhttp://xenbits.xen.org/xsa/advisory-485.html

All References (10)

→
https://git.kernel.org/stable/c/27fdbab4221b375de54bf91919798d88520c6e28Patch
→
https://git.kernel.org/stable/c/4b4defd2fce3f966c25adabf46644a85558f1169Patch
→
https://git.kernel.org/stable/c/52cecff98bda2c51eed1c6ce9d21c5d6268fb19dPatch
→
https://git.kernel.org/stable/c/5c5ff7c7bd15bb536f44b10b3fb5b8408f344d0aPatch
→
https://git.kernel.org/stable/c/8288d031a01dbacfde3fc643f7be3d23504de64dPatch
→
https://git.kernel.org/stable/c/d5f59216650c51e5e3fcb7517c825bc8047f60efPatch
→
https://git.kernel.org/stable/c/e3af585e1728c917682b6a3de9a69b41fb9194d4Patch
→
https://git.kernel.org/stable/c/f458ba102da97fafca106327086fc95f3fc764cbPatch
→
http://www.openwall.com/lists/oss-security/2026/04/28/12Mailing List · Third Party Advisory
→
http://xenbits.xen.org/xsa/advisory-485.htmlMailing List · Third Party Advisory

Quick Facts

CVE IDCVE-2026-31786
CVSS Score7.8 / 10
SeverityHIGH
CISA KEVNo
EPSS (30d)0.01%
Affected1 vendor
PublishedApr 30, 2026

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2026-31786 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2026-31786·NVD