The Linux kernel contained a vulnerability (CVE-2026-31430) in the X.509 certificate parsing logic where an out-of-bounds access occurred due to reading the first byte of an extension before verifying its length. This could be exploited by an unprivileged user submitting a crafted certificate through the keyrings API, potentially causing a denial of service or other impacts related to memory corruption. The issue has been resolved in Linux kernel versions 6.8.0-1064.72~22.04.1 and later. The vendor advisory from Ubuntu confirms that a patch is available and recommends updating to the fixed kernel versions. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, reflecting local attack vector with low complexity, requiring low privileges, no user interaction, and resulting in high confidentiality and availability impact.

An unprivileged local attacker could exploit this vulnerability by submitting a specially crafted certificate to the kernel's keyrings API, causing out-of-bounds memory access. This may lead to denial of service or exposure of sensitive information. The CVSS score of 7.1 indicates a medium severity with high confidentiality and availability impact but no integrity impact. No known exploits in the wild have been reported.

A patch is available and has been released by the vendor. Users should update their Linux kernel to version 6.8.0-1064.72~22.04.1 or later as provided in the Ubuntu security notices USN-8567-1 and USN-8574-1. After applying the update, a system reboot is required to activate the fixes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow the vendor's update instructions carefully.