Junglewise Threat Intelligence

CVE-2026-31412: Linux kernel integer overflow in USB Mass Storage gadget

CVE-2026-31412 · Severity: medium · CVSS 5.5 · Published 2026-04-10

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's USB Mass Storage gadget driver, which allows a device to act as a USB drive. A malicious USB host can send specially crafted storage commands that cause an internal calculation error. This can lead to system instability, memory corruption, or a system crash, potentially disrupting operations on the affected machine.

Technical details

An integer overflow vulnerability exists in the `check_command_size_in_blocks()` function within `drivers/usb/gadget/function/f_mass_storage.c`. The flaw occurs when the function calculates data size by left-shifting `common->data_size_from_cmnd` by the block size (`common->curlun->blkbits`) without validation. A malicious USB host can send SCSI READ or WRITE commands with large data requests, causing the shift operation to wrap around. This results in a truncated data size that bypasses subsequent boundary checks, leading to out-of-bounds memory access or corruption. The issue is resolved by using the `check_shl_overflow()` macro to safely perform the shift.

Affected products

  • Linux Linux kernel 3.3 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc4

Timeline

  • 2026-02-28: other: Vulnerability fixed in upstream commit 8479891d1f04a8ce55366fe4ca361ccdb96f02e1
  • 2026-04-10: disclosed: CVE-2026-31412 published

References