Loading vulnerability…
Out-of-Bounds Read in Linux Xen Build-ID Sysfs Handler
CVE-2026-31786 (XSA-485) is an out-of-bounds read and potential buffer-overflow vulnerability in the Linux kernel Xen hypervisor sysfs handler in drivers/xen/sys-hypervisor.c. The build ID returned by HYPERVISOR_xen_version(XENVER_build_id) is binary data rather than a NUL-terminated string, but buildid_show processed it with sprintf(). As a result, sprintf() reads and copies beyond the intended build-ID data until it finds a NUL byte. Under uncommon memory conditions, this can also write beyond the sysfs output buffer. The upstream correction uses memcpy() to copy the binary build ID with its proper length.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A user in an affected Linux Xen domain may be able to cause disclosure of kernel-resident data, including kernel secrets. The flaw can also cause denial of service and may enable privilege escalation if memory beyond the sysfs buffer is overwritten.
If you can’t patch tonight, do this now.
No temporary mitigation or workaround is known. Apply the fixed kernel update.
Patch, then assume compromise.
Install a vendor-fixed Linux kernel containing the CVE-2026-31786/XSA-485 patch, which replaces the unsafe sprintf() operation with a length-bounded memcpy() operation. Reboot after installing the updated kernel so that the fixed kernel is running.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.