CVE-2026-31659 Affecting kernel-uek-modules-wireless package, versions <0:6.12.0-204.92.4.2.el9uek
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ORACLE9-KERNELUEKMODULESWIRELESS-17867602
- published6 Jul 2026
- disclosed24 Apr 2026
Introduced: 24 Apr 2026
CVE-2026-31659 (opens in a new tab)How to fix?
Upgrade Oracle:9 kernel-uek-modules-wireless to version 0:6.12.0-204.92.4.2.el9uek or higher.
This issue was patched in ELSA-2026-50372.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-uek-modules-wireless package and not the kernel-uek-modules-wireless package as distributed by Oracle.
See How to fix? for Oracle:9 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: reject oversized global TT response buffers
batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries. When a remote originator advertises a large enough global TT, the TT payload length plus the VLAN header offset can exceed 65535 and wrap before kmalloc().
The full-table response path still uses the original TT payload length when it fills tt_change, so the wrapped allocation is too small and batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object before the later packet-size check runs.
Fix this by rejecting TT responses whose TVLV value length cannot fit in the 16-bit TVLV payload length field.
References
- https://linux.oracle.com/cve/CVE-2026-31659.html
- https://linux.oracle.com/errata/ELSA-2026-50372.html
- https://git.kernel.org/stable/c/2997f4bd1f982e7013709946e00be89b507693fa
- https://git.kernel.org/stable/c/3a359bf5c61d52e7f09754108309d637532164a6
- https://git.kernel.org/stable/c/69d61639bc7e963c3b645e570279d731e7c89062
- https://git.kernel.org/stable/c/7e5d007e0df946bffb8542fb112e0044014a5897
- https://git.kernel.org/stable/c/95c71365a2222908441b54d6f2c315e0c79fcec3
- https://git.kernel.org/stable/c/cf2199171ef799ca7270019125f4a91bd20ad4d9
- https://git.kernel.org/stable/c/de6c1dc3c7d01a152607e6fcecee4d5288283f10
- https://git.kernel.org/stable/c/f970646b9a39539d1bac86822ac78b5915455ea9