High severity7.8NVD Advisory· Published May 1, 2026· Updated Jun 17, 2026
CVE-2026-31720
CVE-2026-31720
Description
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_uac1_legacy: validate control request size
f_audio_complete() copies req->length bytes into a 4-byte stack variable:
u32 data = 0; memcpy(&data, req->buf, req->length);
req->length is derived from the host-controlled USB request path, which can lead to a stack out-of-bounds write.
Validate req->actual against the expected payload size for the supported control selectors and decode only the expected amount of data.
This avoids copying a host-influenced length into a fixed-size stack object.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
22cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 7 more
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=2.6.31,<5.10.253
- cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
- (no CPE)
- osv-coords14 versionspkg:linux/kernelpkg:rpm/opensuse/dtb-aarch64&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-64kb&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-azure&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-default&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-default-base&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-docs&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-kvmsmall&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-obs-build&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-obs-qa&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-rt&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-syms&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kernel-zfcpdump&distro=openSUSE%20Leap%2016.0
>= 2.6.31, < 5.10.253+ 13 more
- (no CPE)range: >= 2.6.31, < 5.10.253
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1.160000.2.19
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
- (no CPE)range: < 6.12.0-160000.37.1
Patches
Vulnerability mechanics
References
8- git.kernel.org/stable/c/0d41772d98dcaf6c17e875b7d0ea0154ae1191eenvdPatch
- git.kernel.org/stable/c/21b11e8581285c6f10ef43d05df349d445f24273nvdPatch
- git.kernel.org/stable/c/26304d124e7f0383f8fe1168b5801a0ac7e16b1cnvdPatch
- git.kernel.org/stable/c/557d1d4e862eccd0b74cc377b66de3e1e8d49605nvdPatch
- git.kernel.org/stable/c/6e0e34d85cd46ceb37d16054e97a373a32770f6cnvdPatch
- git.kernel.org/stable/c/8e5eb1d6e6a3d7bbea9c92132d0cda5793176426nvdPatch
- git.kernel.org/stable/c/be2d32f0c3fe333d14c0a9ca90328dacbc3e06b8nvdPatch
- git.kernel.org/stable/c/c6da4fed7537aec19880c24f6c3a95065adb1406nvdPatch
News mentions
0No linked articles in our index yet.