ACK: [SRU][Q][PATCH 0/1] CVE-2026-31405

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/24/26 08:32, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-31405
>
> [ Impact ]
>
> The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables in
> handle_one_ule_extension() of the dvb-net driver are declared with 255 elements
> (valid indices 0-254), but the index htype is derived from network-controlled
> data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When htype equals
> 255, an out-of-bounds read occurs on the function pointer table, and the OOB
> value may be called as a function pointer. As this index is controlled by
> network data, a remote attacker could trigger the out-of-bounds access,
> potentially leading to memory disclosure or arbitrary code execution.
>
> [ Fix ]
>
> questing: clean cherry-pick
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this fix would affect the DVB network (dvb-net) subsystem's ULE
> decapsulation path; an incorrect bounds check could cause valid SNDUs to be
> wrongly discarded, breaking reception of MPE/ULE-encapsulated network traffic
> over DVB devices.
>