# CVE-2026-31494: net: macb: use the current queue number for stats CVE-2026-31494 is fixed in 46 products on 1 platform, first by DEBIAN-CVE-2026-31494, released May 15, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-31494 - Priority: High - CVSS: 7.8 (Important) - EPSS: 0.0014 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Apr 22, 2026 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31494 ## Description In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats There's a potential mismatch between the memory reserved for statistics and the amount of memory written. gem_get_sset_count() correctly computes the number of stats based on the active queues, whereas gem_get_ethtool_stats() indiscriminately copies data using the maximum number of queues, and in the case the number of active queues is less than MACB_MAX_QUEUES, this results in a OOB write as observed in the KASAN splat. ================================================================== BUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78 [macb] Write of size 760 at addr ffff80008080b000 by task ethtool/1027 CPU: [...] Tainted: [E]=UNSIGNED_MODULE Hardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025 Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x80/0xf8 print_report+0x384/0x5e0 kasan_report+0xa0/0xf0 kasan_check_range+0xe8/0x190 __asan_memcpy+0x54/0x98 gem_get_ethtool_stats+0x54/0x78 [macb 926c13f3af83b0c6fe64badb21ec87d5e93fcf65] dev_ethtool+0x1220/0x38c0 dev_ioctl+0x4ac/0xca8 sock_do_ioctl+0x170/0x1d8 sock_ioctl+0x484/0x5d8 __arm64_sys_ioctl+0x12c/0x1b8 invoke_syscall+0xd4/0x258 el0_svc_common.constprop.0+0xb4/0x240 do_el0_svc+0x48/0x68 el0_svc+0x40/0xf8 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1b0/0x1b8 The buggy address belongs to a 1-page vmalloc region starting at 0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff00000a333000 pfn:0xa333 flags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff) raw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ================================================================== Fix it by making sure the copied size only considers the active number of queues. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | kernel-64kb sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-azure sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-default sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-default-base sles 15.7 | 6.4.0-150700.53.55.1.150700.17.33.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-docs sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-livepatch-SLE15-SP7_Update_15 sles 15.7 | 1-150700.15.3.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-obs-build sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-source sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-syms sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | kernel-uek ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-core ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-core ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-core ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-core ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-devel ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-devel ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules-core ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules-core ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules-deprecated ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules-deprecated ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules-desktop ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules-desktop ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules-extra ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules-extra ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules-extra-netfilter ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules-extra-netfilter ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules-usb ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules-usb ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules-wireless ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-debug-modules-wireless ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-devel ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-devel ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-doc ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-doc ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules-core ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules-core ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules-deprecated ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules-deprecated ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules-desktop ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules-desktop ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules-extra ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules-extra ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules-extra-netfilter ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules-extra-netfilter ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules-usb ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules-usb ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules-wireless ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-modules-wireless ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-tools ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek-tools ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-core ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-core ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-devel ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-devel ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules-core ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules-core ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules-deprecated ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules-deprecated ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules-desktop ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules-desktop ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules-extra ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules-extra ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules-extra-netfilter ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules-extra-netfilter ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules-usb ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules-usb ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules-wireless ol 10 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-uek64k-modules-wireless ol 9 | 0:6.12.0-204.92.4.2.el9uek | [ELSA-2026-50372](https://patchblox.com/security/data/fix/linux/elsa-2026-50372.md) | Jul 2, 2026 | | Linux | kernel-zfcpdump sles 15.7 | 6.4.0-150700.53.55.1 | [SUSE-SU-2026:2238-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2238-1.md) | Jun 30, 2026 | | Linux | linux Debian 12.15 (bookworm) | 6.1.170-1 | [DEBIAN-CVE-2026-31494](https://patchblox.com/security/data/fix/linux/debian-cve-2026-31494.md) | May 15, 2026 | | Linux | linux Debian 13.5 (trixie) | 6.12.85-1 | [DEBIAN-CVE-2026-31494](https://patchblox.com/security/data/fix/linux/debian-cve-2026-31494.md) | May 15, 2026 | | Linux | linux Debian 14 | 6.19.11-1 | [DEBIAN-CVE-2026-31494](https://patchblox.com/security/data/fix/linux/debian-cve-2026-31494.md) | May 15, 2026 | --- Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.