SB2026032091 - Out-of-bounds write in Linux kernel google gve driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026032091

SB2026032091 - Out-of-bounds write in Linux kernel google gve driver

Published: March 20, 2026

Security Bulletin ID SB2026032091
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Out-of-bounds write (CVE-ID: CVE-2026-23262)

The vulnerability allows a local user to cause memory corruption and incorrect statistics reporting.

The vulnerability exists due to improper buffer size management in the gve driver's statistics reporting region when changing the number of queues. A local user can trigger a queue count change to cause the NIC to write past the allocated stats region or create gaps in stats reporting.

The issue arises because the driver and NIC miscalculate offsets into the shared memory region during queue count changes, potentially leading to memory corruption or incorrect statistics.


Remediation

Install update from vendor's website.

References