CVE-2026-31412
Analyzed Analyzed - Analysis Complete
Integer Overflow in Linux USB f_mass_storage Causes Memory Corruption

Publication date: 2026-04-10

Last updated on: 2026-05-20

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() The `check_command_size_in_blocks()` function calculates the data size in bytes by left shifting `common->data_size_from_cmnd` by the block size (`common->curlun->blkbits`). However, it does not validate whether this shift operation will cause an integer overflow. Initially, the block size is set up in `fsg_lun_open()` , and the `common->data_size_from_cmnd` is set up in `do_scsi_command()`. During initialization, there is no integer overflow check for the interaction between two variables. So if a malicious USB host sends a SCSI READ or WRITE command requesting a large amount of data (`common->data_size_from_cmnd`), the left shift operation can wrap around. This results in a truncated data size, which can bypass boundary checks and potentially lead to memory corruption or out-of-bounds accesses. Fix this by using the check_shl_overflow() macro to safely perform the shift and catch any overflows.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-10
Last Modified
2026-05-20
Generated
2026-06-16
AI Q&A
2026-04-10
EPSS Evaluated
2026-06-15
NVD
CVE-2026-31412
EUVD
EUVD-2026-21361
Affected Vendors & Products
Showing 9 associated CPEs
Vendor Product Version / Range
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.2 (inc) to 6.6.130 (exc)
linux linux_kernel From 6.13 (inc) to 6.18.19 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.78 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.9 (exc)
linux linux_kernel From 3.3 (inc) to 6.1.167 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's USB gadget mass storage function (f_mass_storage). Specifically, the function check_command_size_in_blocks() calculates the data size by left shifting a value representing the data size from a SCSI command by the block size. However, it does not check if this left shift causes an integer overflow.

If a malicious USB host sends a SCSI READ or WRITE command requesting a very large amount of data, the left shift operation can overflow and wrap around, resulting in a truncated data size. This truncated size can bypass boundary checks, potentially leading to memory corruption or out-of-bounds memory access.

The vulnerability was fixed by adding a safe check using the check_shl_overflow() macro to detect and prevent such overflows.

Impact Analysis

This vulnerability can impact you by allowing a malicious USB host to cause memory corruption or out-of-bounds memory access on a device running the affected Linux kernel. This can lead to system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges.

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version that includes the fix for the integer overflow in the usb gadget f_mass_storage driver.

The fix involves safely performing the left shift operation in check_command_size_in_blocks() using the check_shl_overflow() macro to prevent overflow and potential memory corruption.

Until the update is applied, avoid connecting untrusted USB hosts that may send malicious SCSI READ or WRITE commands to the affected system.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31412. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart