CVE-2026-31607

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31607", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.122Z", "datePublished": "2026-04-24T14:42:29.468Z", "dateUpdated": "2026-10-19T18:56:00.074Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:23:45.870Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: validate number_of_packets in usbip_pack_ret_submit()\n\nWhen a USB/IP client receives a RET_SUBMIT response,\nusbip_pack_ret_submit() unconditionally overwrites\nurb->number_of_packets from the network PDU. This value is\nsubsequently used as the loop bound in usbip_recv_iso() and\nusbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible\narray whose size was fixed at URB allocation time based on the\n*original* number_of_packets from the CMD_SUBMIT.\n\nA malicious USB/IP server can set number_of_packets in the response\nto a value larger than what was originally submitted, causing a heap\nout-of-bounds write when usbip_recv_iso() writes to\nurb->iso_frame_desc[i] beyond the allocated region.\n\nKASAN confirmed this with kernel 7.0.0-rc5:\n\n BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640\n Write of size 4 at addr ffff888106351d40 by task vhci_rx/69\n\n The buggy address is located 0 bytes to the right of\n allocated 320-byte region [ffff888106351c00, ffff888106351d40)\n\nThe server side (stub_rx.c) and gadget side (vudc_rx.c) already\nvalidate number_of_packets in the CMD_SUBMIT path since commits\nc6688ef9f297 (\"usbip: fix stub_rx: harden CMD_SUBMIT path to handle\nmalicious input\") and b78d830f0049 (\"usbip: fix vudc_rx: harden\nCMD_SUBMIT path to handle malicious input\"). The server side validates\nagainst USBIP_MAX_ISO_PACKETS because no URB exists yet at that point.\nOn the client side we have the original URB, so we can use the tighter\nbound: the response must not exceed the original number_of_packets.\n\nThis mirrors the existing validation of actual_length against\ntransfer_buffer_length in usbip_recv_xbuff(), which checks the\nresponse value against the original allocation size.\n\nKelvin Mbogo's series (\"usb: usbip: fix integer overflow in\nusbip_recv_iso()\", v2) hardens the receive-side functions themselves;\nthis patch complements that work by catching the bad value at its\nsource -- in usbip_pack_ret_submit() before the overwrite -- and\nusing the tighter per-URB allocation bound rather than the global\nUSBIP_MAX_ISO_PACKETS limit.\n\nFix this by checking rpdu->number_of_packets against\nurb->number_of_packets in usbip_pack_ret_submit() before the\noverwrite. On violation, clamp to zero so that usbip_recv_iso() and\nusbip_pad_iso() safely return early."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable client-side VHCI path processes USB/IP RET_SUBMIT responses received over a TCP socket from a remote USB/IP server. A malicious or compromised server can send the crafted network PDU; physical USB access is not required.\nAC:L - No race or hard-to-control condition is required; the server sees the client CMD_SUBMIT sequence number and can reply with an oversized number_of_packets. The attacker can reasonably present or service an isochronous USB device to reach the iso descriptor path.\nPR:N - The attacker needs no privileges on the vulnerable client system and USB/IP has no authentication gate in this kernel receive path. Once acting as the remote peer, the server-controlled RET_SUBMIT fields are accepted by vhci_rx.\nUI:N - In a reasonable high-impact deployment, the USB/IP client connection may already be established or automatically managed. Exploitation is then triggered solely by the remote server\u2019s response packet without further victim action.\nS:U - The corruption occurs in the client kernel and impacts resources governed by the same kernel security authority. This is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The bug is heap memory corruption caused by attacker-controlled iso descriptors being written past the allocated urb->iso_frame_desc array. Such kernel memory corruption can be leveraged for information disclosure primitives, so confidentiality impact is high.\nI:H - usbip_recv_iso writes attacker-controlled descriptor fields out of bounds into adjacent kernel heap memory. This is a controlled kernel heap overwrite with plausible code execution or privilege escalation impact.\nA:H - KASAN confirmed a slab out-of-bounds write in the vhci_rx kernel thread. Even without full exploitation, a malicious server can crash or destabilize the kernel, causing high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/usbip/usbip_common.c"], "versions": [{"version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "324262c38438255bf6bdbf6342ca47c0badaab76", "status": "affected", "versionType": "git"}, {"version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "973f2c250289f5bf6cc146b98aa6fdde11fe50d6", "status": "affected", "versionType": "git"}, {"version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "ce744264b06b97069b3722511ab355738311fee0", "status": "affected", "versionType": "git"}, {"version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "885c8591784da6314f9aa82fa460ac69f9f79e5f", "status": "affected", "versionType": "git"}, {"version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "8d155e2d1c4102f74f82a2bf9c016164bb0f7384", "status": "affected", "versionType": "git"}, {"version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "906f16a836de13fe61f49cdce2f66f2dbd14caf4", "status": "affected", "versionType": "git"}, {"version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "ef8ebb1c637b4cfb61a9dd2e013376774ee2033b", "status": "affected", "versionType": "git"}, {"version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "5e1c4ece08ccdc197177631f111845a2c68eede3", "status": "affected", "versionType": "git"}, {"version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "2ab833a16a825373aad2ba7d54b572b277e95b71", "status": "affected", "versionType": "git"}, {"version": "d9638d9236eed035a575feddec61d036dacc2676", "status": "affected", "versionType": "git"}, {"version": "ca7d3501b7a287c18b5b470e871d3029b0f4842a", "status": "affected", "versionType": "git"}, {"version": "1ce528277e1a66856ed3f7526c1e3458c0ed4a70", "status": "affected", "versionType": "git"}, {"version": "db898d0c5c493ce4177d5e1d3a953e079a56a24b", "status": "affected", "versionType": "git"}, {"version": "5aa02704b9ee67c5b2ee26d54c5f4eb99e93ba9a", "status": "affected", "versionType": "git"}, {"version": "2.6.32.37", "lessThan": "2.6.33", "status": "affected", "versionType": "semver"}, {"version": "2.6.33.10", "lessThan": "2.6.34", "status": "affected", "versionType": "semver"}, {"version": "2.6.34.11", "lessThan": "2.6.35", "status": "affected", "versionType": "semver"}, {"version": "2.6.35.13", "lessThan": "2.6.36", "status": "affected", "versionType": "semver"}, {"version": "2.6.38.3", "lessThan": "2.6.39", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/usbip/usbip_common.c"], "versions": [{"version": "2.6.39", "status": "affected"}, {"version": "0", "lessThan": "2.6.39", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.1", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.6.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.12.83"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.18.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.19.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "7.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32.37"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.33.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/324262c38438255bf6bdbf6342ca47c0badaab76"}, {"url": "https://git.kernel.org/stable/c/973f2c250289f5bf6cc146b98aa6fdde11fe50d6"}, {"url": "https://git.kernel.org/stable/c/ce744264b06b97069b3722511ab355738311fee0"}, {"url": "https://git.kernel.org/stable/c/885c8591784da6314f9aa82fa460ac69f9f79e5f"}, {"url": "https://git.kernel.org/stable/c/8d155e2d1c4102f74f82a2bf9c016164bb0f7384"}, {"url": "https://git.kernel.org/stable/c/906f16a836de13fe61f49cdce2f66f2dbd14caf4"}, {"url": "https://git.kernel.org/stable/c/ef8ebb1c637b4cfb61a9dd2e013376774ee2033b"}, {"url": "https://git.kernel.org/stable/c/5e1c4ece08ccdc197177631f111845a2c68eede3"}, {"url": "https://git.kernel.org/stable/c/2ab833a16a825373aad2ba7d54b572b277e95b71"}], "title": "usbip: validate number_of_packets in usbip_pack_ret_submit()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:6.12.0-211.16.1.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:6.12.0-55.77.1.el10_0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_extras_rt_els:7"], "defaultStatus": "affected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.10.0-1160.155.1.rt56.1307.el7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:7"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.10.0-1160.151.1.el7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9", "cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.14.0-687.10.1.el9_8", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.14.0-570.119.1.el9_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:6"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "datePublic": "2026-04-24T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A flaw was found in the Linux kernel's USB/IP subsystem. A malicious USB/IP server could exploit a vulnerability in the `usbip_pack_ret_submit()` function by sending a specially crafted `RET_SUBMIT` response. This response, containing an oversized `number_of_packets` value, could cause a heap out-of-bounds write. This issue may lead to a denial of service or potentially arbitrary code execution on the client system."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-805", "description": "Buffer Access with Incorrect Length Value", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-31607"}, {"name": "RHBZ#2461521", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461521"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31607.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:25095"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:41236"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:24343"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:19569"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:23224"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:19568"}], "solutions": [{"lang": "en", "value": "RHSA-2026:25095: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"}, {"lang": "en", "value": "RHSA-2026:41236: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"}, {"lang": "en", "value": "RHSA-2026:24343: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"}, {"lang": "en", "value": "RHSA-2026:19569: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"}, {"lang": "en", "value": "RHSA-2026:23224: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:19568: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"}], "timeline": [{"lang": "en", "time": "2026-04-24T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-24T00:00:00.000Z", "value": "Made public."}], "title": "kernel: usbip: validate number_of_packets in usbip_pack_ret_submit()", "workarounds": [{"lang": "en", "value": "To mitigate this vulnerability, prevent the `usbip` kernel module from loading by blacklisting it. Create a file named `/etc/modprobe.d/blacklist-usbip.conf` with the following content:\n\n```\nblacklist usbip\n```\n\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact functionality that relies on USB/IP."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-21T12:13:01.495Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31607", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:11:11.271174Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:56:00.074Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "kernel: usbip: validate number_of_packets in usbip_pack_ret_submit()", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:6.12.0-211.16.1.el10_2", "lessThan": "*", "versionType": "rpm"}], "packageName": "kernel", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:6.12.0-55.77.1.el10_0", "lessThan": "*", "versionType": "rpm"}], "packageName": "kernel", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_extras_rt_els:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "versions": [{"status": "unaffected", "version": "0:3.10.0-1160.155.1.rt56.1307.el7", "lessThan": "*", "versionType": "rpm"}], "packageName": "kernel-rt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_els:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "versions": [{"status": "unaffected", "version": "0:3.10.0-1160.151.1.el7", "lessThan": "*", "versionType": "rpm"}], "packageName": "kernel", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9", "cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:5.14.0-687.10.1.el9_8", "lessThan": "*", "versionType": "rpm"}], "packageName": "kernel", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:5.14.0-570.119.1.el9_6", "lessThan": "*", "versionType": "rpm"}], "packageName": "kernel", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "kernel", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "kernel", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "kernel-rt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "kernel-rt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-24T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-24T00:00:00.000Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:25095: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"}, {"lang": "en", "value": "RHSA-2026:41236: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"}, {"lang": "en", "value": "RHSA-2026:24343: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"}, {"lang": "en", "value": "RHSA-2026:19569: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"}, {"lang": "en", "value": "RHSA-2026:23224: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:19568: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"}], "x_adpType": "supplier", "datePublic": "2026-04-24T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-31607", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461521", "name": "RHBZ#2461521", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31607.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:25095", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:41236", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:24343", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:19569", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:23224", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:19568", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "To mitigate this vulnerability, prevent the `usbip` kernel module from loading by blacklisting it. Create a file named `/etc/modprobe.d/blacklist-usbip.conf` with the following content:\n\n```\nblacklist usbip\n```\n\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact functionality that relies on USB/IP."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the Linux kernel's USB/IP subsystem. A malicious USB/IP server could exploit a vulnerability in the `usbip_pack_ret_submit()` function by sending a specially crafted `RET_SUBMIT` response. This response, containing an oversized `number_of_packets` value, could cause a heap out-of-bounds write. This issue may lead to a denial of service or potentially arbitrary code execution on the client system."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-805", "description": "Buffer Access with Incorrect Length Value"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-21T12:13:01.495Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31607", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:11:11.271174Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:11:11.814Z"}}], "cna": {"title": "usbip: validate number_of_packets in usbip_pack_ret_submit()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable client-side VHCI path processes USB/IP RET_SUBMIT responses received over a TCP socket from a remote USB/IP server. A malicious or compromised server can send the crafted network PDU; physical USB access is not required.\nAC:L - No race or hard-to-control condition is required; the server sees the client CMD_SUBMIT sequence number and can reply with an oversized number_of_packets. The attacker can reasonably present or service an isochronous USB device to reach the iso descriptor path.\nPR:N - The attacker needs no privileges on the vulnerable client system and USB/IP has no authentication gate in this kernel receive path. Once acting as the remote peer, the server-controlled RET_SUBMIT fields are accepted by vhci_rx.\nUI:N - In a reasonable high-impact deployment, the USB/IP client connection may already be established or automatically managed. Exploitation is then triggered solely by the remote server\u2019s response packet without further victim action.\nS:U - The corruption occurs in the client kernel and impacts resources governed by the same kernel security authority. This is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The bug is heap memory corruption caused by attacker-controlled iso descriptors being written past the allocated urb->iso_frame_desc array. Such kernel memory corruption can be leveraged for information disclosure primitives, so confidentiality impact is high.\nI:H - usbip_recv_iso writes attacker-controlled descriptor fields out of bounds into adjacent kernel heap memory. This is a controlled kernel heap overwrite with plausible code execution or privilege escalation impact.\nA:H - KASAN confirmed a slab out-of-bounds write in the vhci_rx kernel thread. Even without full exploitation, a malicious server can crash or destabilize the kernel, causing high availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "324262c38438255bf6bdbf6342ca47c0badaab76", "versionType": "git"}, {"status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "973f2c250289f5bf6cc146b98aa6fdde11fe50d6", "versionType": "git"}, {"status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "ce744264b06b97069b3722511ab355738311fee0", "versionType": "git"}, {"status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "885c8591784da6314f9aa82fa460ac69f9f79e5f", "versionType": "git"}, {"status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "8d155e2d1c4102f74f82a2bf9c016164bb0f7384", "versionType": "git"}, {"status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "906f16a836de13fe61f49cdce2f66f2dbd14caf4", "versionType": "git"}, {"status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "ef8ebb1c637b4cfb61a9dd2e013376774ee2033b", "versionType": "git"}, {"status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "5e1c4ece08ccdc197177631f111845a2c68eede3", "versionType": "git"}, {"status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "lessThan": "2ab833a16a825373aad2ba7d54b572b277e95b71", "versionType": "git"}, {"status": "affected", "version": "d9638d9236eed035a575feddec61d036dacc2676", "versionType": "git"}, {"status": "affected", "version": "ca7d3501b7a287c18b5b470e871d3029b0f4842a", "versionType": "git"}, {"status": "affected", "version": "1ce528277e1a66856ed3f7526c1e3458c0ed4a70", "versionType": "git"}, {"status": "affected", "version": "db898d0c5c493ce4177d5e1d3a953e079a56a24b", "versionType": "git"}, {"status": "affected", "version": "5aa02704b9ee67c5b2ee26d54c5f4eb99e93ba9a", "versionType": "git"}, {"status": "affected", "version": "2.6.32.37", "lessThan": "2.6.33", "versionType": "semver"}, {"status": "affected", "version": "2.6.33.10", "lessThan": "2.6.34", "versionType": "semver"}, {"status": "affected", "version": "2.6.34.11", "lessThan": "2.6.35", "versionType": "semver"}, {"status": "affected", "version": "2.6.35.13", "lessThan": "2.6.36", "versionType": "semver"}, {"status": "affected", "version": "2.6.38.3", "lessThan": "2.6.39", "versionType": "semver"}], "programFiles": ["drivers/usb/usbip/usbip_common.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.39"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.39", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.136", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.83", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.24", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.14", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0.1", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/usb/usbip/usbip_common.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/324262c38438255bf6bdbf6342ca47c0badaab76"}, {"url": "https://git.kernel.org/stable/c/973f2c250289f5bf6cc146b98aa6fdde11fe50d6"}, {"url": "https://git.kernel.org/stable/c/ce744264b06b97069b3722511ab355738311fee0"}, {"url": "https://git.kernel.org/stable/c/885c8591784da6314f9aa82fa460ac69f9f79e5f"}, {"url": "https://git.kernel.org/stable/c/8d155e2d1c4102f74f82a2bf9c016164bb0f7384"}, {"url": "https://git.kernel.org/stable/c/906f16a836de13fe61f49cdce2f66f2dbd14caf4"}, {"url": "https://git.kernel.org/stable/c/ef8ebb1c637b4cfb61a9dd2e013376774ee2033b"}, {"url": "https://git.kernel.org/stable/c/5e1c4ece08ccdc197177631f111845a2c68eede3"}, {"url": "https://git.kernel.org/stable/c/2ab833a16a825373aad2ba7d54b572b277e95b71"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: validate number_of_packets in usbip_pack_ret_submit()\n\nWhen a USB/IP client receives a RET_SUBMIT response,\nusbip_pack_ret_submit() unconditionally overwrites\nurb->number_of_packets from the network PDU. This value is\nsubsequently used as the loop bound in usbip_recv_iso() and\nusbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible\narray whose size was fixed at URB allocation time based on the\n*original* number_of_packets from the CMD_SUBMIT.\n\nA malicious USB/IP server can set number_of_packets in the response\nto a value larger than what was originally submitted, causing a heap\nout-of-bounds write when usbip_recv_iso() writes to\nurb->iso_frame_desc[i] beyond the allocated region.\n\nKASAN confirmed this with kernel 7.0.0-rc5:\n\n BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640\n Write of size 4 at addr ffff888106351d40 by task vhci_rx/69\n\n The buggy address is located 0 bytes to the right of\n allocated 320-byte region [ffff888106351c00, ffff888106351d40)\n\nThe server side (stub_rx.c) and gadget side (vudc_rx.c) already\nvalidate number_of_packets in the CMD_SUBMIT path since commits\nc6688ef9f297 (\"usbip: fix stub_rx: harden CMD_SUBMIT path to handle\nmalicious input\") and b78d830f0049 (\"usbip: fix vudc_rx: harden\nCMD_SUBMIT path to handle malicious input\"). The server side validates\nagainst USBIP_MAX_ISO_PACKETS because no URB exists yet at that point.\nOn the client side we have the original URB, so we can use the tighter\nbound: the response must not exceed the original number_of_packets.\n\nThis mirrors the existing validation of actual_length against\ntransfer_buffer_length in usbip_recv_xbuff(), which checks the\nresponse value against the original allocation size.\n\nKelvin Mbogo's series (\"usb: usbip: fix integer overflow in\nusbip_recv_iso()\", v2) hardens the receive-side functions themselves;\nthis patch complements that work by catching the bad value at its\nsource -- in usbip_pack_ret_submit() before the overwrite -- and\nusing the tighter per-URB allocation bound rather than the global\nUSBIP_MAX_ISO_PACKETS limit.\n\nFix this by checking rpdu->number_of_packets against\nurb->number_of_packets in usbip_pack_ret_submit() before the\noverwrite. On violation, clamp to zero so that usbip_recv_iso() and\nusbip_pad_iso() safely return early."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.258", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.209", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.136", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.83", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.24", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.14", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.1", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "2.6.39"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "2.6.32.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "2.6.33.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "2.6.34.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "2.6.35.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "2.6.38.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:23:45.870Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31607", "state": "PUBLISHED", "dateUpdated": "2026-10-19T18:56:00.074Z", "dateReserved": "2026-03-09T15:48:24.122Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-24T14:42:29.468Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/usbip/usbip_common.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "324262c38438255bf6bdbf6342ca47c0badaab76", "status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "versionType": "git"}, {"lessThan": "973f2c250289f5bf6cc146b98aa6fdde11fe50d6", "status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "versionType": "git"}, {"lessThan": "ce744264b06b97069b3722511ab355738311fee0", "status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "versionType": "git"}, {"lessThan": "885c8591784da6314f9aa82fa460ac69f9f79e5f", "status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "versionType": "git"}, {"lessThan": "8d155e2d1c4102f74f82a2bf9c016164bb0f7384", "status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "versionType": "git"}, {"lessThan": "906f16a836de13fe61f49cdce2f66f2dbd14caf4", "status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "versionType": "git"}, {"lessThan": "ef8ebb1c637b4cfb61a9dd2e013376774ee2033b", "status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "versionType": "git"}, {"lessThan": "5e1c4ece08ccdc197177631f111845a2c68eede3", "status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "versionType": "git"}, {"lessThan": "2ab833a16a825373aad2ba7d54b572b277e95b71", "status": "affected", "version": "1325f85fa49f57df034869de430f7c302ae23109", "versionType": "git"}, {"status": "affected", "version": "d9638d9236eed035a575feddec61d036dacc2676", "versionType": "git"}, {"status": "affected", "version": "ca7d3501b7a287c18b5b470e871d3029b0f4842a", "versionType": "git"}, {"status": "affected", "version": "1ce528277e1a66856ed3f7526c1e3458c0ed4a70", "versionType": "git"}, {"status": "affected", "version": "db898d0c5c493ce4177d5e1d3a953e079a56a24b", "versionType": "git"}, {"status": "affected", "version": "5aa02704b9ee67c5b2ee26d54c5f4eb99e93ba9a", "versionType": "git"}, {"lessThan": "2.6.33", "status": "affected", "version": "2.6.32.37", "versionType": "semver"}, {"lessThan": "2.6.34", "status": "affected", "version": "2.6.33.10", "versionType": "semver"}, {"lessThan": "2.6.35", "status": "affected", "version": "2.6.34.11", "versionType": "semver"}, {"lessThan": "2.6.36", "status": "affected", "version": "2.6.35.13", "versionType": "semver"}, {"lessThan": "2.6.39", "status": "affected", "version": "2.6.38.3", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/usbip/usbip_common.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.39"}, {"lessThan": "2.6.39", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.136", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.83", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.24", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.14", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:6.12.0-211.16.1.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:6.12.0-55.77.1.el10_0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_extras_rt_els:7"], "defaultStatus": "affected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.10.0-1160.155.1.rt56.1307.el7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:7"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.10.0-1160.151.1.el7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9", "cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.14.0-687.10.1.el9_8", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.14.0-570.119.1.el9_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:6"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "kernel", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "kernel-rt", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "860F82EF-76BF-492E-B7CE-559EC99F9C95", "versionEndExcluding": "6.6.136", "versionStartIncluding": "2.6.39", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8", "versionEndExcluding": "6.12.83", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A", "versionEndExcluding": "7.0.1", "versionStartIncluding": "7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: validate number_of_packets in usbip_pack_ret_submit()\n\nWhen a USB/IP client receives a RET_SUBMIT response,\nusbip_pack_ret_submit() unconditionally overwrites\nurb->number_of_packets from the network PDU. This value is\nsubsequently used as the loop bound in usbip_recv_iso() and\nusbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible\narray whose size was fixed at URB allocation time based on the\n*original* number_of_packets from the CMD_SUBMIT.\n\nA malicious USB/IP server can set number_of_packets in the response\nto a value larger than what was originally submitted, causing a heap\nout-of-bounds write when usbip_recv_iso() writes to\nurb->iso_frame_desc[i] beyond the allocated region.\n\nKASAN confirmed this with kernel 7.0.0-rc5:\n\n BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640\n Write of size 4 at addr ffff888106351d40 by task vhci_rx/69\n\n The buggy address is located 0 bytes to the right of\n allocated 320-byte region [ffff888106351c00, ffff888106351d40)\n\nThe server side (stub_rx.c) and gadget side (vudc_rx.c) already\nvalidate number_of_packets in the CMD_SUBMIT path since commits\nc6688ef9f297 (\"usbip: fix stub_rx: harden CMD_SUBMIT path to handle\nmalicious input\") and b78d830f0049 (\"usbip: fix vudc_rx: harden\nCMD_SUBMIT path to handle malicious input\"). The server side validates\nagainst USBIP_MAX_ISO_PACKETS because no URB exists yet at that point.\nOn the client side we have the original URB, so we can use the tighter\nbound: the response must not exceed the original number_of_packets.\n\nThis mirrors the existing validation of actual_length against\ntransfer_buffer_length in usbip_recv_xbuff(), which checks the\nresponse value against the original allocation size.\n\nKelvin Mbogo's series (\"usb: usbip: fix integer overflow in\nusbip_recv_iso()\", v2) hardens the receive-side functions themselves;\nthis patch complements that work by catching the bad value at its\nsource -- in usbip_pack_ret_submit() before the overwrite -- and\nusing the tighter per-URB allocation bound rather than the global\nUSBIP_MAX_ISO_PACKETS limit.\n\nFix this by checking rpdu->number_of_packets against\nurb->number_of_packets in usbip_pack_ret_submit() before the\noverwrite. On violation, clamp to zero so that usbip_recv_iso() and\nusbip_pad_iso() safely return early."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusbip: validar number_of_packets en usbip_pack_ret_submit()\n\nCuando un cliente USB/IP recibe una respuesta RET_SUBMIT,\nusbip_pack_ret_submit() sobrescribe incondicionalmente\nurb -> number_of_packets del PDU de red. Este valor se utiliza\nposteriormente como l\u00edmite de bucle en usbip_recv_iso() y\nusbip_pad_iso() para iterar sobre urb -> iso_frame_desc[], un array\nflexible cuyo tama\u00f1o se fij\u00f3 en el momento de la asignaci\u00f3n del URB\nbas\u00e1ndose en el number_of_packets original del CMD_SUBMIT.\n\nUn servidor USB/IP malicioso puede establecer number_of_packets en la\nrespuesta a un valor mayor que el que se envi\u00f3 originalmente, causando\nuna escritura fuera de l\u00edmites en el heap cuando usbip_recv_iso()\nescribe en urb -> iso_frame_desc[i] m\u00e1s all\u00e1 de la regi\u00f3n asignada.\n\nKASAN confirm\u00f3 esto con el kernel 7.0.0-rc5:\n\n BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640\n Write of size 4 at addr ffff888106351d40 by task vhci_rx/69\n\n The buggy address is located 0 bytes to the right of\n allocated 320-byte region [ffff888106351c00, ffff888106351d40)\n\nEl lado del servidor (stub_rx.c) y el lado del gadget (vudc_rx.c) ya\nvalidan number_of_packets en la ruta CMD_SUBMIT desde los commits\nc6688ef9f297 (\u2019usbip: fix stub_rx: harden CMD_SUBMIT path to handle\nmalicious input\u2019) y b78d830f0049 (\u2019usbip: fix vudc_rx: harden\nCMD_SUBMIT path to handle malicious input\u2019). El lado del servidor\nvalida contra USBIP_MAX_ISO_PACKETS porque a\u00fan no existe un URB en ese\npunto. En el lado del cliente tenemos el URB original, por lo que\npodemos usar el l\u00edmite m\u00e1s estricto: la respuesta no debe exceder el\nnumber_of_packets original.\n\nEsto refleja la validaci\u00f3n existente de actual_length contra\ntransfer_buffer_length en usbip_recv_xbuff(), que verifica el valor de\nrespuesta contra el tama\u00f1o de asignaci\u00f3n original.\n\nLa serie de Kelvin Mbogo (\u2019usb: usbip: fix desbordamiento de entero en\nusbip_recv_iso()\u2019, v2) refuerza las propias funciones del lado de\nrecepci\u00f3n; este parche complementa ese trabajo al detectar el valor\nincorrecto en su origen - - en usbip_pack_ret_submit() antes de la\nsobrescritura - - y utilizando el l\u00edmite de asignaci\u00f3n por URB m\u00e1s\nestricto en lugar del l\u00edmite global USBIP_MAX_ISO_PACKETS.\n\nSolucione esto verificando rpdu -> number_of_packets contra\nurb -> number_of_packets en usbip_pack_ret_submit() antes de la\nsobrescritura. En caso de violaci\u00f3n, se ajusta a cero para que\nusbip_recv_iso() y usbip_pad_iso() regresen de forma segura y\nanticipada."}], "id": "CVE-2026-31607", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31607", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:11:11.271174Z", "version": "2.0.3"}}]}, "published": "2026-04-24T15:16:39.940", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2ab833a16a825373aad2ba7d54b572b277e95b71"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/324262c38438255bf6bdbf6342ca47c0badaab76"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5e1c4ece08ccdc197177631f111845a2c68eede3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/885c8591784da6314f9aa82fa460ac69f9f79e5f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8d155e2d1c4102f74f82a2bf9c016164bb0f7384"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/906f16a836de13fe61f49cdce2f66f2dbd14caf4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/973f2c250289f5bf6cc146b98aa6fdde11fe50d6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ce744264b06b97069b3722511ab355738311fee0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ef8ebb1c637b4cfb61a9dd2e013376774ee2033b"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:19568"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:19569"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:23224"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:24343"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:25095"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:41236"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-31607"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461521"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31607.json"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-805"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: usbip: validate number_of_packets in usbip_pack_ret_submit()", "id": "2461521", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461521"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["A flaw was found in the Linux kernel's USB/IP subsystem. A malicious USB/IP server could exploit a vulnerability in the `usbip_pack_ret_submit()` function by sending a specially crafted `RET_SUBMIT` response. This response, containing an oversized `number_of_packets` value, could cause a heap out-of-bounds write. This issue may lead to a denial of service or potentially arbitrary code execution on the client system."], "name": "CVE-2026-31607", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31607\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31607\nhttps://lore.kernel.org/linux-cve-announce/2026042420-CVE-2026-31607-7bac@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1325f85fa49f57df034869de430f7c302ae23109,885c8591784da6314f9aa82fa460ac69f9f79e5f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1325f85fa49f57df034869de430f7c302ae23109,8d155e2d1c4102f74f82a2bf9c016164bb0f7384)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1325f85fa49f57df034869de430f7c302ae23109,906f16a836de13fe61f49cdce2f66f2dbd14caf4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1325f85fa49f57df034869de430f7c302ae23109,ef8ebb1c637b4cfb61a9dd2e013376774ee2033b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1325f85fa49f57df034869de430f7c302ae23109,5e1c4ece08ccdc197177631f111845a2c68eede3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1325f85fa49f57df034869de430f7c302ae23109,2ab833a16a825373aad2ba7d54b572b277e95b71)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "d9638d9236eed035a575feddec61d036dacc2676"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "ca7d3501b7a287c18b5b470e871d3029b0f4842a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "1ce528277e1a66856ed3f7526c1e3458c0ed4a70"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "db898d0c5c493ce4177d5e1d3a953e079a56a24b"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "5aa02704b9ee67c5b2ee26d54c5f4eb99e93ba9a"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.39"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.39)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.136,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.83,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.24,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.14,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0.1,7.0.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-29T01:39:55.050448+00:00", "value": {"mitigation_remediation": ["Apply the latest Linux kernel update that includes the usbip_pack_ret_submit fix; this is the official vendor patch.", "If an immediate kernel update is not possible, unload or disable the vhci-hcd module to prevent the USB/IP client from processing incoming packets.", "Restrict network access to the USB/IP server by using firewall rules, VPN, or other controls so that only trusted servers can communicate with the client."], "summary": {"action": "Immediate Patch", "impact": "Kernel memory corruption"}, "threat_synthesis": {"affected_systems": "Any Linux kernel installation that includes the USB/IP client and has not applied the patch is potentially vulnerable. The specific kernel versions affected are not listed in the CVE data, so affected releases cannot be enumerated.", "description_and_impact": "usbip_pack_ret_submit() overwrites urb->number_of_packets with a value received from a USB/IP server. If the server supplies a larger value than originally allocated, usbip_recv_iso() will iterate beyond the end of the usb->iso_frame_desc array, causing a heap out\u2011of\u2011bounds write. The description indicates a heap overflow that could corrupt kernel memory. The possibility of turning this into arbitrary code execution is not explicitly stated, but it is a logical inference based on the severity and nature of the bug.", "risk_and_exploitability": "The CVSS score of 9.8 reflects a high severity, while the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not in the CISA KEV list. An attacker who controls a USB/IP server could send a crafted RET_SUBMIT response that triggers the out\u2011of\u2011bounds write. While the description does not state the exact outcome, such memory corruption could lead to privilege escalation or denial of service; the exact effect is inferred from similar bugs."}}}}, "created": "2026-04-27T19:00:15.602078+00:00", "updated": "2026-04-29T01:45:26.025889+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}