CVE-2026-31521

A flaw was found in the Linux kernel. The module loader, specifically in the simplify_symbols() function, does not properly validate the bounds of the ELF (Executable and Linkable Format) section index. An attacker could craft a malicious module with an out-of-bounds st_shndx value, leading to a kernel panic and a Denial of Service (DoS) on the system.

Upstream bounds-checks st_shndx before indexing sechdrs[], covering corrupted or tool-generated ELF seen in the wild. Red Hat reminds customers that loading unsigned or untrusted kernel modules is outside supported policy; nonetheless the hardening prevents fatal faults. Consume patched kernels; there is no safe unload mitigation for the loader itself.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.