Bug 2464096 (CVE-2026-31786)

Summary: CVE-2026-31786 kernel: Buffer overflow in drivers/xen/sys-hypervisor.c
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel. A buffer overflow vulnerability exists in the Xen hypervisor driver (`drivers/xen/sys-hypervisor.c`). This flaw occurs because the `HYPERVISOR_xen_version(XENVER_build_id)` function returns a build ID that is not properly null-terminated. When the `buildid_show` function attempts to process this non-null-terminated string using `sprintf`, it can read and copy beyond the intended buffer boundary, potentially leading to a denial of service or other unspecified impacts.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-04-30 12:01:38 UTC 
In the Linux kernel, the following vulnerability has been resolved:

Buffer overflow in drivers/xen/sys-hypervisor.c

The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is
neither NUL terminated nor a string.

The first causes a buffer overflow as sprintf in buildid_show will
read and copy till it finds a NUL.

00000000  f4 91 51 f4 dd 38 9e 9d  65 47 52 eb 10 71 db 50  |..Q..8..eGR..q.P|
00000010  b9 a8 01 42 6f 2e 32                              |...Bo.2|
00000017

So use a memcpy instead of sprintf to have the correct value:

00000000  f4 91 51 f4 dd 00 9e 9d  65 47 52 eb 10 71 db 50  |..Q.....eGR..q.P|
00000010  b9 a8 01 42                                       |...B|
00000014

(the above have a hack to embed a zero inside and check it's
returned correctly).

This is XSA-485 / CVE-2026-31786
Comment 1 Keith Grant 2026-05-01 14:37:19 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026043031-CVE-2026-31786-826a@gregkh/T
Comment 3 errata-xmlrpc 2026-06-08 12:55:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:24381 https://access.redhat.com/errata/RHSA-2026:24381
Comment 4 errata-xmlrpc 2026-06-16 18:29:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:26428 https://access.redhat.com/errata/RHSA-2026:26428
Comment 5 errata-xmlrpc 2026-06-16 18:55:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:26427 https://access.redhat.com/errata/RHSA-2026:26427
Comment 6 errata-xmlrpc 2026-06-19 23:21:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:27288 https://access.redhat.com/errata/RHSA-2026:27288