Executive brief
A vulnerability in the Linux kernel's USB modem driver could allow a malicious physical USB device to crash the system. By mimicking a specific type of modem (CDC Phonet), the device can send excessive data that overflows internal memory structures. This results in a system failure (denial of service) when the malicious device is connected.
Technical details
A buffer overflow vulnerability exists in the 'cdc-phonet' USB driver within the Linux kernel's networking stack. The 'rx_complete()' function fails to validate the number of fragments added to a socket buffer (skb) during bulk transfers. A malicious USB device can send an unbounded sequence of full-page transfers, exceeding the 'MAX_SKB_FRAGS' limit and causing a kernel panic or memory corruption. The fix introduces a check against 'MAX_SKB_FRAGS' and drops the packet if the limit is reached. This issue is tracked as CWE-120.
Affected products
- Linux Linux Kernel 2.6.31 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
- 2026-04-11: patched: Initial patch authored by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/0c5c65a17db729fc63ab656bdaaf0e675a9dbeac
- https://git.kernel.org/stable/c/600dc40554dc5ad1e6f3af51f700228033f43ea7
- https://git.kernel.org/stable/c/6053620fdbcd89fa7e755644efdaab78e0daaae7
- https://git.kernel.org/stable/c/6807ff49bf796b3823b1e29f97b69316a40a9a94
- https://git.kernel.org/stable/c/9989938d13cc5ba8447eeed5a61acfcf61bc6801
- https://git.kernel.org/stable/c/a23b1b1aaf41e174181d5853a70e65d4d01e648c
- https://git.kernel.org/stable/c/c183d5775129a0a7495bd61a6e57ec230dcf01e5