CVE-2026-31616

Vulnerability

Overview

CVE-2026-31616 is a medium-severity vulnerability in the Linux kernel's USB gadget subsystem, specifically in the f_phonet function. The root cause is an unbounded accumulation of fragments in the skb_shared_info->frags[] array within pn_rx_complete(). When a malicious USB host sends a sequence of OUT transfers that are exactly PAGE_SIZE bytes each, the driver never finalizes the skb (because req->actual never becomes less than req->length), and each completion adds a new fragment via skb_add_rx_frag(). Once the number of fragments exceeds MAX_SKB_FRAGS (default 17), subsequent writes corrupt heap memory adjacent to the shared info structure [1][2].

Exploitation and

Attack Surface

Exploitation requires a malicious USB host connected to a Linux device that exposes a Phonet function through the USB gadget framework. No authentication is needed; the host simply sends USB OUT transfers of exactly PAGE_SIZE bytes repeatedly. The attack surface is limited to physical USB connections or virtual USB-over-IP scenarios where the host can control transfer sizes. The vulnerability is triggered entirely by the host's behavior, without any special privileges on the gadget side [3].

Impact

A successful overflow can corrupt kernel heap memory, potentially leading to a denial of service (system crash) or, in more sophisticated attacks, arbitrary code execution in kernel privileges. The CVSS v3 base score of 5.5 reflects a medium severity, with high availability impact and low attack complexity [].

Mitigation

The fix, already merged into the stable kernel tree, drops the skb and accounts a length error when the fragment limit is reached, mirroring a similar fix in the t7xx driver (commit f0813bcd2d9d). Users should apply the relevant stable kernel updates containing commits 66f7471c4042, 9ceff1251904, c088d5dd2fff, or bd44ce09b9b5 [1][2][3][4]. No workaround is available; updating the kernel is the recommended mitigation.