CVE-2026-31412

Vulnerability

Overview

CVE-2026-31412 is an integer overflow flaw in the Linux kernel's USB Mass Storage gadget driver (f_mass_storage). The vulnerability resides in the check_command_size_in_blocks() function, which calculates the data size in bytes by left-shifting a command's data length (common->data_size_from_cmnd) by the logical block size (common->curlun->blkbits). The shift is performed without any overflow validation, allowing a malicious USB host to trigger a wraparound that produces a truncated, small value instead of the intended large size [1][2][3][4].

Exploitation

Scenario

To exploit this issue, an attacker must have physical access to the target device and be able to act as a USB host, sending crafted SCSI READ or WRITE commands to the gadget's storage LUN. The data_size_from_cmnd is set during command processing in do_scsi_command(); combined with the block size set during LUN initialization in fsg_lun_open(), no bounds check exists to prevent the shift from overflowing. The overflow bypasses subsequent boundary checks, enabling the attacker to cause memory corruption or out-of-bounds reads/writes on the kernel heap [3].

Impact

Successful exploitation could lead to kernel memory corruption, potentially resulting in a denial-of-service condition (system crash) or, in more severe scenarios, arbitrary code execution in kernel context. The CVSS v3 base score of 5.5 (Medium) reflects the need for physical USB access and the potential for high impact on confidentiality, integrity, and availability.

Mitigation

The fix, introduced via commits in the stable kernel tree [1][2][3][4], uses the check_shl_overflow() macro to safely detect and handle integer overflow during the shift operation. As of April 2026, patches are available for multiple stable kernel branches. Users should apply the latest updates from their distribution. No workaround exists; physical USB port restrictions can reduce the attack surface but do not eliminate the risk from trusted peripherals.