CVE-2026-31412
Integer Overflow in Linux USB f_mass_storage Causes Memory Corruption
Publication date: 2026-04-10
Last updated on: 2026-04-10
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's USB gadget mass storage function (f_mass_storage). Specifically, the function check_command_size_in_blocks() calculates the data size by left shifting a value representing the data size from a SCSI command by the block size. However, it does not check if this left shift causes an integer overflow.
If a malicious USB host sends a SCSI READ or WRITE command requesting a very large amount of data, the left shift operation can overflow and wrap around, resulting in a truncated data size. This truncated size can bypass boundary checks, potentially leading to memory corruption or out-of-bounds memory access.
The vulnerability was fixed by adding a safe check using the check_shl_overflow() macro to detect and prevent such overflows.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing a malicious USB host to cause memory corruption or out-of-bounds memory access on a device running the affected Linux kernel. This can lead to system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version that includes the fix for the integer overflow in the usb gadget f_mass_storage driver.
The fix involves safely performing the left shift operation in check_command_size_in_blocks() using the check_shl_overflow() macro to prevent overflow and potential memory corruption.
Until the update is applied, avoid connecting untrusted USB hosts that may send malicious SCSI READ or WRITE commands to the affected system.