CVE-2026-31743: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31743 Overview

CVE-2026-31743 is a high-severity out-of-bounds write vulnerability in the Linux kernel's zynqmp_nvmem driver. The flaw stems from an incorrect buffer size used in dma_alloc_coherent and memcpy operations. The undersized DMA buffer allocation can lead to memory corruption when the driver accesses non-volatile memory on Xilinx ZynqMP platforms. The issue is tracked under [CWE-787] (Out-of-bounds Write) and affects multiple Linux kernel versions, including the 7.0 release candidate series. Local attackers with low privileges can exploit the condition to compromise confidentiality, integrity, and availability of the affected system.

Critical Impact

An undersized DMA buffer in the zynqmp_nvmem driver can trigger memory corruption, enabling local privilege escalation or kernel-level denial of service on Xilinx ZynqMP-based Linux systems.

Affected Products

• Linux Kernel (multiple stable branches)
• Linux Kernel 7.0-rc1 through 7.0-rc6
• Systems using the Xilinx ZynqMP NVMEM driver (zynqmp_nvmem)

Discovery Timeline

• 2026-05-01 - CVE-2026-31743 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-31743

Vulnerability Analysis

The vulnerability resides in the zynqmp_nvmem driver, which provides access to non-volatile memory on Xilinx ZynqMP system-on-chip platforms. The driver allocates a DMA-coherent buffer using dma_alloc_coherent and later copies data into it using memcpy. Both operations reference an incorrect buffer size value. The mismatch between the allocated buffer size and the actual data length copied results in out-of-bounds writes to adjacent kernel memory.

The defect maps to [CWE-787] Out-of-bounds Write. Memory corruption in DMA-mapped regions is particularly dangerous because the affected memory may be accessible to both the CPU and hardware DMA engines. Successful exploitation can corrupt kernel data structures, function pointers, or page tables.

Root Cause

The root cause is a buffer-size constant or computation error in the zynqmp_nvmem driver source. The driver requests fewer bytes from dma_alloc_coherent than the subsequent memcpy writes into the buffer. Because DMA-coherent allocations are page-aligned, the overflow may silently corrupt neighboring kernel allocations rather than triggering immediate faults. The fix corrects the size argument so that allocation and copy lengths match the data being transferred.

Attack Vector

Exploitation requires local access with low privileges on a Linux system running the vulnerable zynqmp_nvmem driver. An attacker with the ability to invoke NVMEM read or write operations through sysfs or nvmem cell consumers can trigger the undersized buffer path. No user interaction is required. Because the corruption occurs in kernel address space, a successful attack can yield kernel code execution or full system compromise on affected ZynqMP hardware.

No public proof-of-concept exploit code is currently available for CVE-2026-31743. The vulnerability mechanism is documented in the upstream stable kernel commits referenced by the Linux maintainers. See the Kernel Git Commit f9b8861 for the corrected buffer-size handling.

Detection Methods for CVE-2026-31743

Indicators of Compromise

• Unexpected kernel oops or panic messages referencing zynqmp_nvmem or dma_alloc_coherent in dmesg and /var/log/kern.log.
• KASAN or SLUB debug reports flagging out-of-bounds writes adjacent to NVMEM DMA buffers.
• Unexplained corruption of kernel slab objects on Xilinx ZynqMP platforms.

Detection Strategies

• Inventory ZynqMP-based Linux assets and verify the running kernel version against the patched stable branches listed in the kernel.org advisories.
• Enable KASAN (Kernel Address Sanitizer) in test environments to surface out-of-bounds writes during NVMEM access.
• Audit loaded kernel modules for zynqmp_nvmem and correlate with CPE entries published in NVD for CVE-2026-31743.

Monitoring Recommendations

• Monitor kernel logs for repeated faults originating in NVMEM or DMA subsystems on embedded Linux fleets.
• Track local privilege escalation telemetry on ZynqMP devices, including unexpected uid=0 transitions and kernel module load anomalies.
• Centralize embedded device telemetry in a SIEM or data lake to correlate kernel crashes with attempted exploitation patterns.

How to Mitigate CVE-2026-31743

Immediate Actions Required

• Identify all Linux systems running on Xilinx ZynqMP hardware that load the zynqmp_nvmem driver.
• Apply the upstream kernel patches referenced in the kernel.org stable commits as soon as vendor-rebuilt kernels are available.
• Restrict local shell access on affected devices to trusted administrators until patches are deployed.

Patch Information

The Linux kernel maintainers have committed fixes to the stable tree. Update to a kernel build that includes one of the following commits: Kernel Git Commit 2f6e5b9, Kernel Git Commit 6c01e7f, Kernel Git Commit 784ed4a, and Kernel Git Commit f9b8861. Distribution vendors will incorporate these fixes in subsequent kernel package releases for embedded and server distributions.

Workarounds

• Where the patch cannot be applied immediately, blacklist the zynqmp_nvmem module if NVMEM access is not required for the workload.
• Tighten filesystem permissions on /sys/bus/nvmem/devices/ and related sysfs entries to limit which local users can trigger NVMEM operations.
• Enforce least-privilege access on ZynqMP devices and audit any local accounts that retain shell access.