CVE-2026-31720
USB Control Request Size Validation Flaw in Linux Kernel
Publication date: 2026-05-01
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 5.11 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.22 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.168 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.12 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.81 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.134 (exc) |
| linux | linux_kernel | From 2.6.31 (inc) to 5.10.253 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the issue has been resolved.
The vulnerability involves improper validation of USB control request sizes in the f_uac1_legacy driver, which has been fixed by validating the actual request size against the expected payload size.
Therefore, applying the latest kernel patches or updates that include this fix is the immediate step to prevent exploitation.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's USB gadget function f_uac1_legacy, specifically in the f_audio_complete() function. The function copies a number of bytes specified by req->length into a fixed 4-byte stack variable without proper validation. Since req->length is controlled by the host through a USB request, this can lead to a stack out-of-bounds write, potentially causing memory corruption.
The fix involves validating the actual length of the request against the expected payload size for supported control selectors, ensuring only the expected amount of data is copied. This prevents copying a host-influenced length into a fixed-size stack object.
How can this vulnerability impact me? :
This vulnerability can lead to a stack out-of-bounds write, which may cause memory corruption. Such memory corruption can potentially be exploited to crash the system, execute arbitrary code, or escalate privileges, depending on the context and exploitability.