CVE-2026-31430

Vulnerability

CVE-2026-31430 is an out-of-bounds access vulnerability in the Linux kernel's X.509 certificate parsing code. The bug occurs when the parser encounters a certificate with an empty Basic Constraints or Key Usage extension; it reads the first byte of the extension before verifying that the extension's length is non-zero, leading to an out-of-bounds read [1][2].

Exploitation

An unprivileged user can trigger the vulnerability by submitting a specially crafted certificate to the kernel through the keyrings(7) API. A proof-of-concept program has been demonstrated by the reporter, Leo, who responsibly disclosed the issue off-list [1]. No authentication or special privileges are required beyond the ability to add a key to the kernel keyring.

Impact

Impact

Successful exploitation results in an out-of-bounds memory access, which could lead to information disclosure or a system crash (denial of service). The exact impact depends on memory layout and kernel hardening measures, but the bug is classified as a security vulnerability due to the potential for privilege escalation or data leakage [1].

Mitigation

The fix has been applied to the Linux kernel stable tree in commits 672b526def1f, d702c3408213, 206121294b9c, and 7fb4dadc2734 [1][2][3][4]. Users should update to a kernel version containing these patches. No workaround is available other than applying the update.