{"id":"CVE-2026-31690","state":"PUBLISHED","title":"firmware: thead: Fix buffer overflow and use standard endian macros","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: thead: Fix buffer overflow and use standard endian macros\n\nAddresses two issues in the TH1520 AON firmware protocol driver:\n\n1. Fix a potential buffer overflow where the code used unsafe pointer\n   arithmetic to access the 'mode' field through the 'resource' pointer\n   with an offset. This was flagged by Smatch static checker as:\n   \"buffer overflow 'data' 2 <= 3\"\n\n2. Replace custom RPC_SET_BE* and RPC_GET_BE* macros with standard\n   kernel endianness conversion macros (cpu_to_be16, etc.) for better\n   portability and maintainability.\n\nThe functionality was re-tested with the GPU power-up sequence,\nconfirming the GPU powers up correctly and the driver probes\nsuccessfully.\n\n[   12.702370] powervr ffef400000.gpu: [drm] loaded firmware\npowervr/rogue_36.52.104.182_v1.fw\n[   12.711043] powervr ffef400000.gpu: [drm] FW version v1.0 (build\n6645434 OS)\n[   12.719787] [drm] Initialized powervr 1.0.0 for ffef400000.gpu on\nminor 0","publishedAt":"2026-04-27T17:34:28.738Z","updatedAt":"2026-05-11T22:13:45.476Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e4b3cbd840e565484d0ad8d260d27c057466ed17","status":"affected","lessThan":"fbdb43f6bb2a15ed382d6eb0ef82c8b07b0d47bb","versionType":"git"},{"version":"e4b3cbd840e565484d0ad8d260d27c057466ed17","status":"affected","lessThan":"bd15a5deb5a7251dc1a0cf9186f0253f7eacdb97","versionType":"git"},{"version":"e4b3cbd840e565484d0ad8d260d27c057466ed17","status":"affected","lessThan":"88c4bd90725557796c15878b7cb70066e9e6b5ab","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/firmware/thead,th1520-aon.c","include/linux/firmware/thead/thead,th1520-aon.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"6.18.23","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.13","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/firmware/thead,th1520-aon.c","include/linux/firmware/thead/thead,th1520-aon.h"]}],"references":["https://git.kernel.org/stable/c/fbdb43f6bb2a15ed382d6eb0ef82c8b07b0d47bb","https://git.kernel.org/stable/c/bd15a5deb5a7251dc1a0cf9186f0253f7eacdb97","https://git.kernel.org/stable/c/88c4bd90725557796c15878b7cb70066e9e6b5ab"],"weaknesses":[],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/31xxx/CVE-2026-31690.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31690","state":"PUBLISHED","datePublished":"2026-04-27T17:34:28.738Z","dateUpdated":"2026-05-11T22:13:45.476Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-03-09T15:48:24.131Z"},"containers":{"cna":{"title":"firmware: thead: Fix buffer overflow and use standard endian macros","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: thead: Fix buffer overflow and use standard endian macros\n\nAddresses two issues in the TH1520 AON firmware protocol driver:\n\n1. Fix a potential buffer overflow where the code used unsafe pointer\n   arithmetic to access the 'mode' field through the 'resource' pointer\n   with an offset. This was flagged by Smatch static checker as:\n   \"buffer overflow 'data' 2 <= 3\"\n\n2. Replace custom RPC_SET_BE* and RPC_GET_BE* macros with standard\n   kernel endianness conversion macros (cpu_to_be16, etc.) for better\n   portability and maintainability.\n\nThe functionality was re-tested with the GPU power-up sequence,\nconfirming the GPU powers up correctly and the driver probes\nsuccessfully.\n\n[   12.702370] powervr ffef400000.gpu: [drm] loaded firmware\npowervr/rogue_36.52.104.182_v1.fw\n[   12.711043] powervr ffef400000.gpu: [drm] FW version v1.0 (build\n6645434 OS)\n[   12.719787] [drm] Initialized powervr 1.0.0 for ffef400000.gpu on\nminor 0"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e4b3cbd840e565484d0ad8d260d27c057466ed17","status":"affected","lessThan":"fbdb43f6bb2a15ed382d6eb0ef82c8b07b0d47bb","versionType":"git"},{"version":"e4b3cbd840e565484d0ad8d260d27c057466ed17","status":"affected","lessThan":"bd15a5deb5a7251dc1a0cf9186f0253f7eacdb97","versionType":"git"},{"version":"e4b3cbd840e565484d0ad8d260d27c057466ed17","status":"affected","lessThan":"88c4bd90725557796c15878b7cb70066e9e6b5ab","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/firmware/thead,th1520-aon.c","include/linux/firmware/thead/thead,th1520-aon.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"6.18.23","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.13","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/firmware/thead,th1520-aon.c","include/linux/firmware/thead/thead,th1520-aon.h"]}],"references":[{"url":"https://git.kernel.org/stable/c/fbdb43f6bb2a15ed382d6eb0ef82c8b07b0d47bb"},{"url":"https://git.kernel.org/stable/c/bd15a5deb5a7251dc1a0cf9186f0253f7eacdb97"},{"url":"https://git.kernel.org/stable/c/88c4bd90725557796c15878b7cb70066e9e6b5ab"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T22:13:45.476Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.18.23"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.19.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}