Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-31690— firmware: thead: Fix buffer overflow and use standard endian macros

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于TH1520 AON固件协议驱动中存在缓冲区溢出和使用非标准字节序宏的问题。

AI Predicted 5.5 Difficulty: Theoretical EPSS 0.19% · P8

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux e4b3cbd840e565484d0ad8d260d27c057466ed17< fbdb43f6bb2a15ed382d6eb0ef82c8b07b0d47bb affected
e4b3cbd840e565484d0ad8d260d27c057466ed17< bd15a5deb5a7251dc1a0cf9186f0253f7eacdb97 affected
e4b3cbd840e565484d0ad8d260d27c057466ed17< 88c4bd90725557796c15878b7cb70066e9e6b5ab affected
6.15 affected
< 6.15 unaffected
6.18.23≤ 6.18.* unaffected
6.19.13≤ 6.19.* unaffected
7.0≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-31690

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
firmware: thead: Fix buffer overflow and use standard endian macros
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: firmware: thead: Fix buffer overflow and use standard endian macros Addresses two issues in the TH1520 AON firmware protocol driver: 1. Fix a potential buffer overflow where the code used unsafe pointer arithmetic to access the 'mode' field through the 'resource' pointer with an offset. This was flagged by Smatch static checker as: "buffer overflow 'data' 2 <= 3" 2. Replace custom RPC_SET_BE* and RPC_GET_BE* macros with standard kernel endianness conversion macros (cpu_to_be16, etc.) for better portability and maintainability. The functionality was re-tested with the GPU power-up sequence, confirming the GPU powers up correctly and the driver probes successfully. [ 12.702370] powervr ffef400000.gpu: [drm] loaded firmware powervr/rogue_36.52.104.182_v1.fw [ 12.711043] powervr ffef400000.gpu: [drm] FW version v1.0 (build 6645434 OS) [ 12.719787] [drm] Initialized powervr 1.0.0 for ffef400000.gpu on minor 0
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于TH1520 AON固件协议驱动中存在缓冲区溢出和使用非标准字节序宏的问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux e4b3cbd840e565484d0ad8d260d27c057466ed17 ~ fbdb43f6bb2a15ed382d6eb0ef82c8b07b0d47bb -
Linux Linux 6.15 -

II. Public POCs for CVE-2026-31690

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31690

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-31690 (3)

Same Patch Batch · Linux · 2026-04-27 · 5 CVEs total

CVE-2026-31686 mm/kasan: fix double free for kasan pXds
CVE-2026-31687 gpio: omap: do not register driver in probe()
CVE-2026-31689 EDAC/mc: Fix error path ordering in edac_mc_alloc()
CVE-2026-31691 igb: remove napi_synchronize() in igb_down()

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31690

No comments yet

Leave a comment