CVEFinder.io

CVE-2026-31521

🔶 medium
🔍 Scan for this CVE
Summary

In the Linux kernel, the following vulnerability has been resolved: module: Fix kernel panic when a symbol st_shndx is out of bounds The module loader doesn't check for bounds of the ELF section index in simplify_symbols(): for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) { const char *name = info->strtab + sym[i].st_name; switch (sym[i].st_shndx) { case SHN_COMMON: [...] default: /* Divert to percpu allocation if a percpu var. */ if (sym[i].st_shndx == info->

Description

In the Linux kernel, the following vulnerability has been resolved:

module: Fix kernel panic when a symbol st_shndx is out of bounds

The module loader doesn't check for bounds of the ELF section index in
simplify_symbols():

for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
const char *name = info->strtab + sym[i].st_name;

switch (sym[i].st_shndx) {
case SHN_COMMON:

[...]

default:
/* Divert to percpu allocation if a percpu var. */
if (sym[i].st_shndx == info->index.pcpu)
secbase = (unsigned long)mod_percpu(mod);
else
/** HERE --> **/ secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
sym[i].st_value += secbase;
break;
}
}

A symbol with an out-of-bounds st_shndx value, for example 0xffff
(known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic:

BUG: unable to handle page fault for address: ...
RIP: 0010:simplify_symbols+0x2b2/0x480
...
Kernel panic - not syncing: Fatal exception

This can happen when module ELF is legitimately using SHN_XINDEX or
when it is corrupted.

Add a bounds check in simplify_symbols() to validate that st_shndx is
within the valid range before using it.

This issue was discovered due to a bug in llvm-objcopy, see relevant
discussion for details [1].

[1] https://lore.kernel.org/linux-modules/20251224005752.201911-1-ihor.solodrai@linux.dev/

CVSS Score
5.5
Medium
EPSS Score
0.1
Exploit Probability
Published Date
2026-04-22
First Seen: 2026-07-15
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 32.4% of all 335,187 vulnerabilities in our database.

#226,526
Below average severity
Severity Percentile
Last Modified 2026-07-14
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE IDs (Weakness Types)

📦 Affected Products 8

🔗 References 9

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-53325 🔶 medium 5.5 0.1 In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd6... 2026-06-29
CVE-2026-53324 🔶 medium 5.5 0.1 In the Linux kernel, the following vulnerability has been resolved: net: mana: Use pci_name() for debugfs directory nam... 2026-06-26
CVE-2026-53323 🔶 medium 5.5 0.1 In the Linux kernel, the following vulnerability has been resolved: net: dsa: remove redundant netdev_lock_ops() from c... 2026-06-26
CVE-2026-53322 ⚠️ high 8.8 0.2 In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Clean up DMABUFs before disabling functio... 2026-06-26
CVE-2026-53321 🔶 medium 5.5 0.1 In the Linux kernel, the following vulnerability has been resolved: io_uring/napi: cap busy_poll_to 10 msec Currently ... 2026-06-26
CVE-2026-53320 🔶 medium 5.5 0.1 In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark... 2026-06-26
These CVEs affect the same products