Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-31395

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler The ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER handler in bnxt_async_event_process() uses a firmware-supplied 'type' field directly as an index into bp->bs_trace[] without bounds validation. The 'type' field is a 16-bit value extracted from DMA-mapped completion ring memory that the NIC writes directly to host RAM. A malicious or compromised NIC can supply any va
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:be0fc201df7a1008cdc4d0e297c7fcb6b67241414b75065b7075aee634dda6a7
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c","drivers/net/ethernet/broadcom/bnxt/bnxt.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"19aa416eed9e4aaf1bbe8da0f7bd9a9be31158c8","status":"affected","version":"84fcd9449fd7882ddfb05ba64d75f9be2d29b2e9","versionType":"git"},{"lessThan":"b7c7a275447c6d4bf4a36a134682e2e4e20efd4b","status":"affected","version":"84fcd9449fd7882ddfb05ba64d75f9be2d29b2e9","versionType":"git"},{"lessThan":"64dcbde7f8f870a4f2d9daf24ffb06f97…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:70a2f324adbe81e85286a66295aa1b63f10d6921682564ed2e285f97d1771c61 · sha256:bd38d82e7c269db7… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c","drivers/net/ethernet/broadcom/bnxt/bnxt.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffec…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:70a2f324adbe81e85286a66295aa1b63f10d6921682564ed2e285f97d1771c61 · sha256:bd38d82e7c269db7… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c","drivers/net/ethernet/broadcom/bnxt/bnxt.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"19aa416eed9e4aaf1bbe8da0f7bd9a9be31158c8","status":"affected","version":"84fcd9449fd7882ddfb05ba64d75f9be2d29b2e9","versionType":"git"},{"lessThan":"b7c7a275447c6d4bf4a36a134682e2e4e20efd4b","status":"affected","version":"84fcd9449fd7882ddfb05ba64d75f9be2d29b2e9","versionType":"git"},{"lessThan":"64dcbde7f8f870a4f2d9daf24ffb06f97…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:70a2f324adbe81e85286a66295aa1b63f10d6921682564ed2e285f97d1771c61 · sha256:bd38d82e7c269db7… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c","drivers/net/ethernet/broadcom/bnxt/bnxt.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffec…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:70a2f324adbe81e85286a66295aa1b63f10d6921682564ed2e285f97d1771c61 · sha256:bd38d82e7c269db7… · /containers/cna/affected/1

Source references

3 source assertions
{"url":"https://git.kernel.org/stable/c/19aa416eed9e4aaf1bbe8da0f7bd9a9be31158c8"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:70a2f324adbe81e85286a66295aa1b63f10d6921682564ed2e285f97d1771c61 · sha256:bd38d82e7c269db7… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/64dcbde7f8f870a4f2d9daf24ffb06f9748b5dd3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:70a2f324adbe81e85286a66295aa1b63f10d6921682564ed2e285f97d1771c61 · sha256:bd38d82e7c269db7… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/b7c7a275447c6d4bf4a36a134682e2e4e20efd4b"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:70a2f324adbe81e85286a66295aa1b63f10d6921682564ed2e285f97d1771c61 · sha256:bd38d82e7c269db7… · /containers/cna/references/1

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer