{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"MEDIUM" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use scratch field in MMIO fragment to hold small write values\n\nWhen exiting to userspace to service an emulated MMIO write, copy the\nto-be-written value to a scratch field in the MMIO fragment if the size\nof the data payload is 8 bytes or less, i.e. can fit in a single chunk,\ninstead of pointing the fragment directly at the source value.\n\nThis fixes a class of use-after-free bugs that occur when the emulator\ninitiates a write using an on-stack, local variable as the source, the\nwrite splits a page boundary, *and* both pages are MMIO pages. Because\nKVM's ABI only allows for physically contiguous MMIO requests, accesses\nthat split MMIO pages are separated into two fragments, and are sent to\nuserspace one at a time. When KVM attempts to complete userspace MMIO in\nresponse to KVM_RUN after the first fragment, KVM will detect the second\nfragment and generate a second userspace exit, and reference the on-stack\nvariable.\n\nThe issue is most visible if the second KVM_RUN is performed by a separate\ntask, in which case the stack of the initiating task can show up as truly\nfreed data.\n\n ==================================================================\n BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420\n Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984\n\n CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace:\n dump_stack+0xbe/0xfd\n print_address_description.constprop.0+0x19/0x170\n __kasan_report.cold+0x6c/0x84\n kasan_report+0x3a/0x50\n check_memory_region+0xfd/0x1f0\n memcpy+0x20/0x60\n complete_emulated_mmio+0x305/0x420\n kvm_arch_vcpu_ioctl_run+0x63f/0x6d0\n kvm_vcpu_ioctl+0x413/0xb20\n __se_sys_ioctl+0x111/0x160\n do_syscall_64+0x30/0x40\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n RIP: 0033:0x42477d\n Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\n RSP: 002b:00007faa8e6890e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n RAX: ffffffffffffffda RBX: 00000000004d7338 RCX: 000000000042477d\n RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005\n RBP: 00000000004d7330 R08: 00007fff28d546df R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d733c\n R13: 0000000000000000 R14: 000000000040a200 R15: 00007fff28d54720\n\n The buggy address belongs to the page:\n page:0000000029f6a428 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c37\n flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)\n raw: 000fffffc0000000 0000000000000000 ffffea0000270dc8 0000000000000000\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffff888009c37780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff888009c37800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n >ffff888009c37880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ^\n ffff888009c37900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff888009c37980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ==================================================================\n\nThe bug can also be reproduced with a targeted KVM-Unit-Test by hacking\nKVM to fill a large on-stack variable in complete_emulated_mmio(), i.e. by\noverwrite the data value with garbage.\n\nLimit the use of the scratch fields to 8-byte or smaller accesses, and to\njust writes, as larger accesses and reads are not affected thanks to\nimplementation details in the emulator, but add a sanity check to ensure\nthose details don't change in the future. Specifically, KVM never uses\non-stack variables for accesses larger that 8 bytes, e.g. uses an operand\nin the emulator context, and *al\n---truncated---", "category":"general", "title":"Synopsis" } ], "publisher":null, "references":[ { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31588" }, { "summary":"CVE-2026-31588 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/cve/2026/csaf-openeuler-cve-2026-31588.json" }, { "summary":"openEuler-SA-2026-2580", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2580" }, { "summary":"CVE-2026-31588", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-31588&packageName=kernel" } ], "title":"openEuler cve CVE-2026-31588", "tracking":{ "initial_release_date":"2026-06-08T15:16:52+08:00", "revision_history":[ { "date":"2026-06-08T15:16:52+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-06-08T15:16:52+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-06-08T15:16:52+08:00", "id":"CVE-2026-31588", "version":"1.0.0", "status":"interim" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"openEuler-22.03-LTS-SP4", "name":"openEuler-22.03-LTS-SP4" }, "name":"openEuler-22.03-LTS-SP4", "category":"product_version" } ], "category":"product_name" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"bpftool-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "name":"bpftool-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm" }, "name":"bpftool-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "name":"bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm" }, "name":"bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "name":"kernel-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm" }, "name":"kernel-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "name":"kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm" }, "name":"kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "name":"kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm" }, "name":"kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "name":"kernel-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm" }, "name":"kernel-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-headers-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "name":"kernel-headers-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm" }, "name":"kernel-headers-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-source-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "name":"kernel-source-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm" }, "name":"kernel-source-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-tools-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "name":"kernel-tools-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm" }, "name":"kernel-tools-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "name":"kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm" }, "name":"kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "name":"kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm" }, "name":"kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"perf-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "name":"perf-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm" }, "name":"perf-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "name":"perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm" }, "name":"perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"python3-perf-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "name":"python3-perf-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm" }, "name":"python3-perf-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "name":"python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm" }, "name":"python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-5.10.0-317.0.0.220.oe2203sp4.src.rpm", "name":"kernel-5.10.0-317.0.0.220.oe2203sp4.src.rpm" }, "name":"kernel-5.10.0-317.0.0.220.oe2203sp4.src.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"bpftool-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "name":"bpftool-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm" }, "name":"bpftool-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "name":"bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm" }, "name":"bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "name":"kernel-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm" }, "name":"kernel-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "name":"kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm" }, "name":"kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "name":"kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm" }, "name":"kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "name":"kernel-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm" }, "name":"kernel-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-headers-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "name":"kernel-headers-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm" }, "name":"kernel-headers-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-source-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "name":"kernel-source-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm" }, "name":"kernel-source-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-tools-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "name":"kernel-tools-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm" }, "name":"kernel-tools-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "name":"kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm" }, "name":"kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "name":"kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm" }, "name":"kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"perf-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "name":"perf-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm" }, "name":"perf-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "name":"perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm" }, "name":"perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"python3-perf-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "name":"python3-perf-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm" }, "name":"python3-perf-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "name":"python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm" }, "name":"python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"bpftool-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:bpftool-5.10.0-317.0.0.220.oe2203sp4.x86_64", "name":"bpftool-5.10.0-317.0.0.220.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "name":"bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-5.10.0-317.0.0.220.oe2203sp4.x86_64", "name":"kernel-5.10.0-317.0.0.220.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "name":"kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.x86_64", "name":"kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64", "name":"kernel-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-headers-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-headers-5.10.0-317.0.0.220.oe2203sp4.x86_64", "name":"kernel-headers-5.10.0-317.0.0.220.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-source-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-source-5.10.0-317.0.0.220.oe2203sp4.x86_64", "name":"kernel-source-5.10.0-317.0.0.220.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-tools-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-tools-5.10.0-317.0.0.220.oe2203sp4.x86_64", "name":"kernel-tools-5.10.0-317.0.0.220.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "name":"kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64", "name":"kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"perf-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:perf-5.10.0-317.0.0.220.oe2203sp4.x86_64", "name":"perf-5.10.0-317.0.0.220.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "name":"perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"python3-perf-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:python3-perf-5.10.0-317.0.0.220.oe2203sp4.x86_64", "name":"python3-perf-5.10.0-317.0.0.220.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "name":"python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-5.10.0-317.0.0.220.oe2203sp4.src.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-5.10.0-317.0.0.220.oe2203sp4.src", "name":"kernel-5.10.0-317.0.0.220.oe2203sp4.src as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"bpftool-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:bpftool-5.10.0-317.0.0.220.oe2203sp4.aarch64", "name":"bpftool-5.10.0-317.0.0.220.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "name":"bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-5.10.0-317.0.0.220.oe2203sp4.aarch64", "name":"kernel-5.10.0-317.0.0.220.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "name":"kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.aarch64", "name":"kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64", "name":"kernel-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-headers-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-headers-5.10.0-317.0.0.220.oe2203sp4.aarch64", "name":"kernel-headers-5.10.0-317.0.0.220.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-source-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-source-5.10.0-317.0.0.220.oe2203sp4.aarch64", "name":"kernel-source-5.10.0-317.0.0.220.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-tools-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-tools-5.10.0-317.0.0.220.oe2203sp4.aarch64", "name":"kernel-tools-5.10.0-317.0.0.220.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "name":"kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64", "name":"kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"perf-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:perf-5.10.0-317.0.0.220.oe2203sp4.aarch64", "name":"perf-5.10.0-317.0.0.220.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "name":"perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"python3-perf-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:python3-perf-5.10.0-317.0.0.220.oe2203sp4.aarch64", "name":"python3-perf-5.10.0-317.0.0.220.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "name":"python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2026-31588", "notes":[ { "text":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use scratch field in MMIO fragment to hold small write values\n\nWhen exiting to userspace to service an emulated MMIO write, copy the\nto-be-written value to a scratch field in the MMIO fragment if the size\nof the data payload is 8 bytes or less, i.e. can fit in a single chunk,\ninstead of pointing the fragment directly at the source value.\n\nThis fixes a class of use-after-free bugs that occur when the emulator\ninitiates a write using an on-stack, local variable as the source, the\nwrite splits a page boundary, *and* both pages are MMIO pages. Because\nKVM's ABI only allows for physically contiguous MMIO requests, accesses\nthat split MMIO pages are separated into two fragments, and are sent to\nuserspace one at a time. When KVM attempts to complete userspace MMIO in\nresponse to KVM_RUN after the first fragment, KVM will detect the second\nfragment and generate a second userspace exit, and reference the on-stack\nvariable.\n\nThe issue is most visible if the second KVM_RUN is performed by a separate\ntask, in which case the stack of the initiating task can show up as truly\nfreed data.\n\n ==================================================================\n BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420\n Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984\n\n CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace:\n dump_stack+0xbe/0xfd\n print_address_description.constprop.0+0x19/0x170\n __kasan_report.cold+0x6c/0x84\n kasan_report+0x3a/0x50\n check_memory_region+0xfd/0x1f0\n memcpy+0x20/0x60\n complete_emulated_mmio+0x305/0x420\n kvm_arch_vcpu_ioctl_run+0x63f/0x6d0\n kvm_vcpu_ioctl+0x413/0xb20\n __se_sys_ioctl+0x111/0x160\n do_syscall_64+0x30/0x40\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n RIP: 0033:0x42477d\n Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\n RSP: 002b:00007faa8e6890e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n RAX: ffffffffffffffda RBX: 00000000004d7338 RCX: 000000000042477d\n RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005\n RBP: 00000000004d7330 R08: 00007fff28d546df R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d733c\n R13: 0000000000000000 R14: 000000000040a200 R15: 00007fff28d54720\n\n The buggy address belongs to the page:\n page:0000000029f6a428 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c37\n flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)\n raw: 000fffffc0000000 0000000000000000 ffffea0000270dc8 0000000000000000\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffff888009c37780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff888009c37800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n >ffff888009c37880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ^\n ffff888009c37900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff888009c37980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ==================================================================\n\nThe bug can also be reproduced with a targeted KVM-Unit-Test by hacking\nKVM to fill a large on-stack variable in complete_emulated_mmio(), i.e. by\noverwrite the data value with garbage.\n\nLimit the use of the scratch fields to 8-byte or smaller accesses, and to\njust writes, as larger accesses and reads are not affected thanks to\nimplementation details in the emulator, but add a sanity check to ensure\nthose details don't change in the future. Specifically, KVM never uses\non-stack variables for accesses larger that 8 bytes, e.g. uses an operand\nin the emulator context, and *al\n---truncated---", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:bpftool-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-headers-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-source-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-tools-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:perf-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:python3-perf-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-5.10.0-317.0.0.220.oe2203sp4.src", "openEuler-22.03-LTS-SP4:bpftool-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-headers-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-source-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-tools-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:perf-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:python3-perf-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:bpftool-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-headers-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-source-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-tools-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:perf-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:python3-perf-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-5.10.0-317.0.0.220.oe2203sp4.src", "openEuler-22.03-LTS-SP4:bpftool-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-headers-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-source-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-tools-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:perf-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:python3-perf-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64" ], "details":"kernel security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2580" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:bpftool-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-headers-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-source-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-tools-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:perf-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:python3-perf-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:kernel-5.10.0-317.0.0.220.oe2203sp4.src", "openEuler-22.03-LTS-SP4:bpftool-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:bpftool-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-debugsource-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-headers-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-source-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-tools-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-tools-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:kernel-tools-devel-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:perf-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:python3-perf-5.10.0-317.0.0.220.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:python3-perf-debuginfo-5.10.0-317.0.0.220.oe2203sp4.aarch64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-31588" } ] }