CVE-2026-31417

net/x25: Fix overflow when accumulating packets

State: Published
Severity: 7.5 High
Published: Apr 13, 2026
Updated: Oct 15, 2026
Reserved: Mar 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net/x25: Fix overflow when accumulating packets

Add a check to ensure that `x25_sock.fraglen` does not overflow.

The `fraglen` also needs to be resetted when purging `fragment_queue` in `x25_clear_queues()`.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 96fc16370b0bceb289c7e0479bd0540b81e257aaAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 798d613afb64b01a203f448fb0f43c37c6afe79dAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6e568835ea54a3e1d08e310e34f95d434e739477Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1734bd85c5e0a7a801295b729efb56b009cb8fc3Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4e2d1bcef78d21247fe8fef13bc7ed95885df2b5Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8c92969c197b91c134be27dc3afb64ab468853a9Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f953f11ccf4afe6feb635c08145f4240d9a6b544Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a1822cb524e89b4cd2cf0b82e484a2335496a6d9Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.134 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 96fc16370b0bceb289c7e0479bd0540b81e257aaAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 798d613afb64b01a203f448fb0f43c37c6afe79dAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6e568835ea54a3e1d08e310e34f95d434e739477Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1734bd85c5e0a7a801295b729efb56b009cb8fc3Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4e2d1bcef78d21247fe8fef13bc7ed95885df2b5Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8c92969c197b91c134be27dc3afb64ab468853a9Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f953f11ccf4afe6feb635c08145f4240d9a6b544Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a1822cb524e89b4cd2cf0b82e484a2335496a6d9Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.134 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.