Answer in brief
CVE-2026-31464 records a High severity (CVSS 8.1) vulnerability in scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=072b91f9c6510d0ec4a49d07dbc318760c7da7b3 <d842348f8a00d5b1d7358f207eb34ffcf5b16df3 || >=072b91f9c6510d0ec4a49d07dbc318760c7da7b3 <a007246cb6c9ebdc93dafbf63cc2d43d98f402cc || >=072b91f9c6510d0ec4a49d07dbc318760c7da7b3 <394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89 || >=072b91f9c6510d0ec4a49d07dbc318760c7da7b3 <4ed727e35b0ab17d3eeeb1e8023768396e2be161 || >=072b91f9c6510d0ec4a49d07dbc318760c7da7b3 <d1466bf991b2343cf2ba8336e440c8faf3cbb780 || >=072b91f9c6510d0ec4a49d07dbc318760c7da7b3 <786f10b1966e485046839f992e89f2c18cbd1983 || >=072b91f9c6510d0ec4a49d07dbc318760c7da7b3 <bae4df0a643fa7f84663473aa3082a9c2ed139db || >=072b91f9c6510d0ec4a49d07dbc318760c7da7b3 <61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f | d842348f8a00d5b1d7358f207eb34ffcf5b16df3, a007246cb6c9ebdc93dafbf63cc2d43d98f402cc, 394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89, 4ed727e35b0ab17d3eeeb1e8023768396e2be161, d1466bf991b2343cf2ba8336e440c8faf3cbb780, 786f10b1966e485046839f992e89f2c18cbd1983, bae4df0a643fa7f84663473aa3082a9c2ed139db, 61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f |
| Linux/Linuxgeneric | 2.6.27 | Not reported |
Published upstream
Apr 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 16, 2026
In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() A malicious or compromised VIO server can return a num_written value in the discover targets MAD response that exceeds max_targets. This value is stored directly in vhost->num_targets without validation, and is then used as the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which is only allocated for max_targets entries. Indices at or beyond max_targets access kernel memory outside the DMA-coherent allocation. The out-of-bounds data is subsequently embedded in Implicit Logout and PLOGI MADs that are sent back to the VIO server, leaking kernel memory. Fix by clamping num_written to max_targets before storing it.
Quoted source text, attributed separately from HOL analysis.