# CVE-2026-31649: Linux Kernel stmmac integer underflow in jumbo_frm

Source: https://junglewise.ai/threats/cve-2026-31649-linux-kernel-stmmac-integer-underflow-in-jumbo-frm  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-24. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-31649 · Severity: critical · CVSS 9.8 · Published 2026-04-24

A vulnerability exists in the Linux kernel's stmmac network driver, which is commonly used in embedded systems and industrial controllers like Siemens SIMATIC S7-1500. An attacker could send specially crafted network packets to trigger a system crash or gain unauthorized access to sensitive information stored in the device's memory. This could lead to operational downtime or the theft of proprietary data in industrial environments.

Technologies: [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-31649 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-31649 being exploited in the wild.

**How severe is CVE-2026-31649?** Critical severity, with a CVSS score of 9.8, published 24 April 2026.

**Which products and versions are affected?** Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6.

**Is there a fix for CVE-2026-31649?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-31649 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-31649?** Check whether you run Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer underflow vulnerability exists in the jumbo_frm() function within the stmmac driver's chain-mode implementation. The root cause is an unconditional subtraction where the linear buffer length (nopaged_len) is subtracted from the maximum buffer size (bmax) without verifying that nopaged_len is larger. When a packet has a small linear portion but large page fragments, this results in a massive unsigned integer value for the remaining length. This causes a loop to execute excessively, mapping arbitrary kernel memory to the DMA engine via dma_map_single(). On systems without an IOMMU, this allows for kernel memory disclosure and potential hardware-driven memory corruption. The fix involves clamping the buffer length to the minimum of the linear portion and the maximum buffer size.

## Affected products

- Linux Linux Kernel Fixed in versions 10d12b92, 275bdf76, 2c91b399, 513e0673, 51f4e090, 6fca757c, a2b68a9a, b7b80121
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

## Timeline

- 2026-03-31: other: Vulnerability fixed in kernel source by Tyllis Xu
- 2026-04-24: disclosed: CVE published

## References

- [https://git.kernel.org/stable/c/10d12b9240ebf96c785f0e2e4228318cd5f3a3eb](https://git.kernel.org/stable/c/10d12b9240ebf96c785f0e2e4228318cd5f3a3eb)
- [https://git.kernel.org/stable/c/275bdf762e82082f064e60a92448fa2ac43cf95b](https://git.kernel.org/stable/c/275bdf762e82082f064e60a92448fa2ac43cf95b)
- [https://git.kernel.org/stable/c/2c91b39912278d0878f9ba60ba04d2518b18a08d](https://git.kernel.org/stable/c/2c91b39912278d0878f9ba60ba04d2518b18a08d)
- [https://git.kernel.org/stable/c/513e06735f5be575b409d195822195348b164e48](https://git.kernel.org/stable/c/513e06735f5be575b409d195822195348b164e48)
- [https://git.kernel.org/stable/c/51f4e090b9f87b40c21b6daadb5c06e6c0a07b67](https://git.kernel.org/stable/c/51f4e090b9f87b40c21b6daadb5c06e6c0a07b67)
- [https://git.kernel.org/stable/c/6fca757c20396dc2e604dcc61922264e9e3dc803](https://git.kernel.org/stable/c/6fca757c20396dc2e604dcc61922264e9e3dc803)
- [https://git.kernel.org/stable/c/a2b68a9a476b9544ff31f1fbcd5d80867a8a5e2f](https://git.kernel.org/stable/c/a2b68a9a476b9544ff31f1fbcd5d80867a8a5e2f)

## Related threats

- [Linux Kernel denial of service in IPv6 tunneled traffic handling](https://junglewise.ai/threats/cve-2026-43057-linux-kernel-denial-of-service-in-ipv6-tunneled-traffic-handling)
- [Linux Kernel information leak in IPv6 ndisc nduseroptmsg](https://junglewise.ai/threats/cve-2026-43040-linux-kernel-information-leak-in-ipv6-ndisc-nduseroptmsg)
- [Linux kernel information leak in tc_chain_fill_node](https://junglewise.ai/threats/cve-2026-43035-linux-kernel-information-leak-in-tc-chain-fill-node)
- [Linux Kernel memory corruption in crypto authencesn decryption](https://junglewise.ai/threats/cve-2026-43033-linux-kernel-memory-corruption-in-crypto-authencesn-decryption)
- [Linux Kernel BPF verifier incorrect state pruning in regsafe](https://junglewise.ai/threats/cve-2026-43030-linux-kernel-bpf-verifier-incorrect-state-pruning-in-regsafe)