CVE-2026-31405

The ULE extension handler tables (ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[]) are declared with 255 elements (valid indices 0–254). The htype index is determined from network-controlled data via the expression (ule_sndu_type & 0x00FF), which yields a range of 0–255. When htype takes the value 255, an out-of-bounds read occurs in the function pointer table. The value read in this way can then be invoked as a function pointer, opening a path to code execution. The fix introduces a check of the htype value against the table size before its use — SNDU packets with values outside the range are now rejected.

An attacker supplying properly crafted network data can trigger an out-of-bounds memory read and potentially execute arbitrary code in the kernel context, which may result in complete system compromise.

Apply patches available from the vendor according to references (commits published in the kernel.org/stable repository)

Linux kernel — versions indicated in vendor references (commits available in the stable repository at kernel.org)