CVE detail
CVE-2026-31786
In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string. The first causes a buffer overflow as sprintf in buildid_show will read and copy till it finds a NUL. 00000000 f4 91 51 f4 dd 38 9e 9d 65 47 52 eb 10 71 db 50 |..Q..8..eGR..q.P| 00000010 b9 a8 01 42 6f 2e 32 |...Bo.2| 00000017 So use a memcpy instead of sprintf to have the correct value: 00000000 f4 91 51 f4 dd 00 9e 9d 65 47 52 eb 10 71 db 50 |..Q.....eGR..q.P| 00000010 b9 a8 01 42 |...B| 00000014 (the above have a hack to embed a zero inside and check it's returned correctly). This is XSA-485 / CVE-2026-31786
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 24.0 · diversity 15.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
10 source links · newest first
- http://xenbits.xen.org/xsa/advisory-485.htmlxenbits.xen.org
No excerpt available.
Vendor Advisoryxenbits.xen.orgApr 30, 2026, 11:16 AM - http://www.openwall.com/lists/oss-security/2026/04/28/12www.openwall.com
No excerpt available.
Exploitwww.openwall.comApr 30, 2026, 11:16 AM No excerpt available.
Patchgit.kernel.orgApr 30, 2026, 11:16 AMNo excerpt available.
Patchgit.kernel.orgApr 30, 2026, 11:16 AMNo excerpt available.
Patchgit.kernel.orgApr 30, 2026, 11:16 AMNo excerpt available.
Patchgit.kernel.orgApr 30, 2026, 11:16 AMNo excerpt available.
Patchgit.kernel.orgApr 30, 2026, 11:16 AMNo excerpt available.
Patchgit.kernel.orgApr 30, 2026, 11:16 AMNo excerpt available.
Patchgit.kernel.orgApr 30, 2026, 11:16 AMNo excerpt available.
Patchgit.kernel.orgApr 30, 2026, 11:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-14063CVSS 5.7 · Medium
Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memory via malicious net…
- CVE-2026-13873CVSS 6.5 · Medium
Out of bounds read in Layout in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML p…
- CVE-2026-53246CVSS 9.8 · Critical
In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes…
- CVE-2026-53209CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising instances can alrea…
- CVE-2026-53205CVSS 7.1 · High
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write indices in the firm…
- CVE-2026-53203CVSS 7.1 · High
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add buffer overflow check in MS get_info_ioctl Add validation that the info size returned from th…