What is CVE-2026-31742?

CVE-2026-31742 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, classified as a Out-of-bounds Read flaw (CWE-125), affecting Linux kernel versions from 6.18.20 onward and patched in 6.18.22 and 6.19.12. CVE-2026-31742 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-31742?

CVE-2026-31742 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2026-31742?

Yes, CVE-2026-31742 has been patched. Fixed versions include 6.18.22 and 6.19.12. If you are running Linux kernel 6.18.20 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-31742 actively exploited?

CVE-2026-31742 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Out-of-bounds Read (CWE-125)?

The product reads data past the end or before the beginning of the intended buffer. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/125.html

CVE-2026-31742

High

In the Linux kernel, the following vulnerability has been resolved: vt: discard stale unicode buffer on alt screen exit after resize When enter_alt_screen() saves vc_uni_lines into vc_saved_uni_lines and sets vc_uni_lines to NULL, a subsequent console resize via vc_do_resize() skips reallocating the unicode buffer because vc_uni_lines is NULL. However, vc_saved_uni_lines still points to the old buffer allocated for the original dimensions. When leave_alt_screen() later restores vc_saved_uni_lines, the buffer dimensions no longer match vc_rows/vc_cols. Any operation that iterates over the unicode buffer using the current dimensions (e.g. csi_J clearing the screen) will access memory out of bounds, causing a kernel oops: BUG: unable to handle page fault for address: 0x0000002000000020 RIP: 0010:csi_J+0x133/0x2d0 The faulting address 0x0000002000000020 is two adjacent u32 space characters (0x20) interpreted as a pointer, read from the row data area past the end of the 25-entry pointer array in a buffer allocated for 80x25 but accessed with 240x67 dimensions. Fix this by checking whether the console dimensions changed while in the alternate screen. If they did, free the stale saved buffer instead of restoring it. The unicode screen will be lazily rebuilt via vc_uniscr_check() when next needed.

Package Linux Kernel

Published 2026-05-01

Last modified 2026-05-07

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-125

CVE-2026-31742 is a Out-of-bounds Read vulnerability

What is Out-of-bounds Read?

The product reads data past the end or before the beginning of the intended buffer. Learn more on MITRE CWE

Affected versions

Linux kernel versions 6.18.20, 6.19.10 and later are affected. Fixed in 6.18.22, 6.19.12 and their respective stable series.

Affected from

≥ 6.18.20 ≥ 6.19.10

Fixed in

✓ 6.18.22 6.18.x ✓ 6.19.12 6.19.x

References

3 total

Kernel Git
https://git.kernel.org/stable/c/40014493cece72a0be5672cd86763e53fb3ec613

Patch
Kernel Git
https://git.kernel.org/stable/c/428fdf55301e6c8fa5a36b426240797b1cf86570

Patch
Kernel Git
https://git.kernel.org/stable/c/891d790fdb5c96c6e1d2841e06ee6c360f2d1288

Patch

Details

CVE ID CVE-2026-31742

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2026-05-01

Modified 2026-05-07

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-31742?

CVE-2026-31742 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 , classified as an Out-of-bounds Read flaw (CWE-125) . It affects Linux kernel versions from 6.18.20 onward and has been patched in 6.18.22 and 6.19.12. CVE-2026-31742 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-31742?

CVE-2026-31742 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2026-31742?

Yes. CVE-2026-31742 has been patched. Fixed versions include 6.18.22 and 6.19.12. If you are running Linux kernel 6.18.20 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-31742 actively exploited?

No. CVE-2026-31742 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.