Executive brief
A vulnerability in the Linux kernel's USB gadget driver could allow a malicious USB host to crash the system. By sending a specifically crafted sequence of data packets, an attacker can cause a memory overflow in the device's memory. This primarily impacts the availability of the device, potentially leading to a denial-of-service or system instability.
Technical details
A heap overflow exists in the Linux kernel's USB gadget Phonet function (f_phonet.c). The function pn_rx_complete() fails to validate the number of fragments added to a socket buffer (skb) when receiving data from a USB host. If a host sends a continuous sequence of transfers exactly matching the PAGE_SIZE, the driver continuously adds fragments via skb_add_rx_frag() without resetting the skb. When the number of fragments exceeds MAX_SKB_FRAGS (typically 17), subsequent writes overwrite adjacent heap memory. This can be exploited by a malicious USB host to cause a kernel panic or memory corruption. The issue has been resolved by adding a check to drop the skb and record a length error when the fragment limit is reached.
Affected products
- Linux Linux Kernel 2.6.32 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
- 2026-04-07: patched: Initial patch authored by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/3d7f7e0c842242878c24b2facff8d6eda23ee1e9
- https://git.kernel.org/stable/c/4e476c25bfcab0535ba7c76a903ae77ca8747711
- https://git.kernel.org/stable/c/66f7471c4042e4eb300e30b5b9d87d1406862673
- https://git.kernel.org/stable/c/7424f0287da73d3d8c5fa5e9d25d26fce762708e
- https://git.kernel.org/stable/c/9ceff1251904901b0b4e5fe6350fcaffa368ce83
- https://git.kernel.org/stable/c/b5ec49fa198bd08967a3102bd41f53ccadce72c9
- https://git.kernel.org/stable/c/bd44ce09b9b569f49ed13e2d87d23d853fc7d6a7