CVE-2026-31521: Linux Kernel out-of-bounds read in module loader simplify_symbols

CVE-2026-31521 · Severity: medium · CVSS 5.5 · Published 2026-04-22

A vulnerability in the Linux kernel's module loader can cause the entire system to crash (kernel panic) when attempting to load a specially crafted or corrupted kernel module. This issue occurs because the system fails to verify certain internal index values within the module file before using them. An attacker with local access or a system processing corrupted files could trigger a complete service outage.

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP. Vendors: Linux, Siemens.

Quick answers

Is CVE-2026-31521 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-31521 being exploited in the wild.
How severe is CVE-2026-31521?
Medium severity, with a CVSS score of 5.5, published 22 April 2026.
Which products and versions are affected?
Linux Kernel All versions prior to the April 2026 patches; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6.
Is there a fix for CVE-2026-31521?
A patch was published on 2026-04-02: Commits merged into various Linux stable branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-31521 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-31521?
Check whether you run Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP or Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability exists in the Linux kernel module loader's 'simplify_symbols()' function. The root cause is a lack of bounds checking on the 'st_shndx' member of the Elf_Sym structure before it is used as an index into the 'info->sechdrs' array. An attacker can provide a malicious ELF module with an invalid section index (such as SHN_XINDEX/0xffff), triggering a page fault and subsequent kernel panic. This vulnerability can be reached during the module loading process, typically requiring local privileges to load modules, though it may also be triggered by corrupted modules generated by buggy tooling. Patches have been released across multiple stable kernel branches to add the necessary bounds validation.

Affected products

  • Linux Linux Kernel All versions prior to the April 2026 patches
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2025-12-30: disclosed: Initial patch submission by Ihor Solodrai
  • 2026-04-02: patched: Commits merged into various Linux stable branches
  • 2026-04-22: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.