CVE-2026-31505

A flaw was found in the Linux kernel's iavf driver. This vulnerability, an out-of-bounds write, occurs when a user simultaneously executes specific ethtool commands, specifically "ethtool -L" and "ethtool -S". This can lead to memory corruption, potentially causing a system crash and resulting in a Denial of Service (DoS).

Upstream aligns num_tx_queues across ethtool stats paths so channel reconfiguration cannot race undersized user buffers. Red Hat treats this as a local CAP_NET_ADMIN-class issue on Intel adaptive virtual function devices. Install updated kernels; optionally unload iavf where virtual NICs are not required.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the iavf module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.