CVE-2026-31720
HIGH EPSS 2.9%
Published May 1, 20262mo ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
Published May 1, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: validate control request size f_audio_complete() copies req->length bytes into a 4-byte stack variable: u32 data = 0; memcpy(&data, req->buf, req->length); req->length is derived from the host-controlled USB request path, which can lead to a stack out-of-bounds write. Validate req->actual against the expected payload size for the supported control selectors and decode only the expected amount of data. This avoids copying a host-influenced length into a fixed-size stack object.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
2.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-787 Out-of-bounds Write Memory Safety
Affected Products 13
| Vendor | Product | Version | Range |
|---|---|---|---|
| linux | linux_kernel | * | ≥2.6.31 – <5.10.253 |
| linux | linux_kernel | * | ≥5.11 – <5.15.203 |
| linux | linux_kernel | * | ≥5.16 – <6.1.168 |
| linux | linux_kernel | * | ≥6.2 – <6.6.134 |
| linux | linux_kernel | * | ≥6.7 – <6.12.81 |
| linux | linux_kernel | * | ≥6.13 – <6.18.22 |
| linux | linux_kernel | * | ≥6.19 – <6.19.12 |
| linux | linux_kernel | 7.0 | any |
| linux | linux_kernel | 7.0 | any |
| linux | linux_kernel | 7.0 | any |
| linux | linux_kernel | 7.0 | any |
| linux | linux_kernel | 7.0 | any |
| linux | linux_kernel | 7.0 | any |
References 8
- git.kernel.org https://git.kernel.org/stable/c/0d41772d98dcaf6c17e875b7d0ea0154ae1191ee
- git.kernel.org https://git.kernel.org/stable/c/21b11e8581285c6f10ef43d05df349d445f24273
- git.kernel.org https://git.kernel.org/stable/c/26304d124e7f0383f8fe1168b5801a0ac7e16b1c
- git.kernel.org https://git.kernel.org/stable/c/557d1d4e862eccd0b74cc377b66de3e1e8d49605
- git.kernel.org https://git.kernel.org/stable/c/6e0e34d85cd46ceb37d16054e97a373a32770f6c
- git.kernel.org https://git.kernel.org/stable/c/8e5eb1d6e6a3d7bbea9c92132d0cda5793176426
- git.kernel.org https://git.kernel.org/stable/c/be2d32f0c3fe333d14c0a9ca90328dacbc3e06b8
- git.kernel.org https://git.kernel.org/stable/c/c6da4fed7537aec19880c24f6c3a95065adb1406
Remediation
- git.kernel.org https://git.kernel.org/stable/c/0d41772d98dcaf6c17e875b7d0ea0154ae1191ee
- git.kernel.org https://git.kernel.org/stable/c/21b11e8581285c6f10ef43d05df349d445f24273
- git.kernel.org https://git.kernel.org/stable/c/26304d124e7f0383f8fe1168b5801a0ac7e16b1c
- git.kernel.org https://git.kernel.org/stable/c/557d1d4e862eccd0b74cc377b66de3e1e8d49605
- git.kernel.org https://git.kernel.org/stable/c/6e0e34d85cd46ceb37d16054e97a373a32770f6c
- git.kernel.org https://git.kernel.org/stable/c/8e5eb1d6e6a3d7bbea9c92132d0cda5793176426
- git.kernel.org https://git.kernel.org/stable/c/be2d32f0c3fe333d14c0a9ca90328dacbc3e06b8
- git.kernel.org https://git.kernel.org/stable/c/c6da4fed7537aec19880c24f6c3a95065adb1406