CVE-2026-31607

Description

In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU. This value is subsequently used as the loop bound in usbip_recv_iso() and usbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible array whose size was fixed at URB allocation time based on the *original* number_of_packets from the CMD_SUBMIT. A malicious USB/IP server can set number_of_packets in the response to a value larger than what was originally submitted, causing a heap out-of-bounds write when usbip_recv_iso() writes to urb->iso_frame_desc[i] beyond the allocated region. KASAN confirmed this with kernel 7.0.0-rc5: BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640 Write of size 4 at addr ffff888106351d40 by task vhci_rx/69 The buggy address is located 0 bytes to the right of allocated 320-byte region [ffff888106351c00, ffff888106351d40) The server side (stub_rx.c) and gadget side (vudc_rx.c) already validate number_of_packets in the CMD_SUBMIT path since commits c6688ef9f297 ("usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input") and b78d830f0049 ("usbip: fix vudc_rx: harden CMD_SUBMIT path to handle malicious input"). The server side validates against USBIP_MAX_ISO_PACKETS because no URB exists yet at that point. On the client side we have the original URB, so we can use the tighter bound: the response must not exceed the original number_of_packets. This mirrors the existing validation of actual_length against transfer_buffer_length in usbip_recv_xbuff(), which checks the response value against the original allocation size. Kelvin Mbogo's series ("usb: usbip: fix integer overflow in usbip_recv_iso()", v2) hardens the receive-side functions themselves; this patch complements that work by catching the bad value at its source -- in usbip_pack_ret_submit() before the overwrite -- and using the tighter per-URB allocation bound rather than the global USBIP_MAX_ISO_PACKETS limit. Fix this by checking rpdu->number_of_packets against urb->number_of_packets in usbip_pack_ret_submit() before the overwrite. On violation, clamp to zero so that usbip_recv_iso() and usbip_pad_iso() safely return early.

CVSS Metrics

• v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
• v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.31%• Percentile: 24%

Techniques & Countermeasures

• CWE-787•Out-of-bounds Write

  The product writes data past the end, or before the beginning, of the intended buffer.

• CWE-805•Buffer Access with Incorrect Length Value

  The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.

Affected Systems

• chainguard•linux-aws-6.12

  < 6.12.85-r0

• chainguard•linux-aws-6.18

  < 6.18.31-r0

• chainguard•linux-azure-6.18

  < 6.18.31-r0

• chainguard•linux-gcp-6.12

  < 6.12.85-r0

• chainguard•linux-gcp-6.18

  < 6.18.31-r0

• chainguard•linux-qemu-6.12

  < 6.12.85-r0

• chainguard•linux-qemu-6.18

  < 6.18.31-r0

• chainguard•linux-qemu-6.18-bootc-boot-installed

  < 6.18.31-r0

• chainguard•linux-vmware-6.12

  < 6.12.85-r0

• chainguard•linux-vmware-6.18

  < 6.18.31-r0

• debian•linux

  < 5.10.259-1 | < 6.1.176-1 | < 6.12.85-1 | < 6.19.14-1

• debian•linux-6.1

  < 6.1.176-1~deb11u1

• ubuntu•linux

  all | < 3.13.0-214.265 | < 4.4.0-283.317 | < 4.15.0-253.265 | < 5.4.0-233.253 | < 5.15.0-185.195 | < 6.8.0-134.134 | < 6.17.0-40.40 | < 7.0.0-27.27

• ubuntu•linux-allwinner-5.19

  all

• ubuntu•linux-aws

  all | < 4.4.0-1156.162 | < 4.4.0-1194.209 | < 4.15.0-1194.207 | < 5.4.0-1161.172 | < 5.15.0-1111.118 | < 6.8.0-1060.63 | < 6.17.0-1019.19 | < 7.0.0-1008.8

• ubuntu•linux-aws-5.0

  all

• ubuntu•linux-aws-5.11

  all

• ubuntu•linux-aws-5.13

  all

• ubuntu•linux-aws-5.15

  < 5.15.0-1111.118~20.04.1

• ubuntu•linux-aws-5.19

  all

• ubuntu•linux-aws-5.3

  all

• ubuntu•linux-aws-5.4

  < 5.4.0-1161.172~18.04.1

• ubuntu•linux-aws-5.8

  all

• ubuntu•linux-aws-6.14

  all

• ubuntu•linux-aws-6.17

  < 6.17.0-1019.19~24.04.1

• ubuntu•linux-aws-6.2

  all

• ubuntu•linux-aws-6.5

  all

• ubuntu•linux-aws-6.8

  < 6.8.0-1060.63~22.04.1

• ubuntu•linux-aws-fips

  < 4.15.0-2132.138 | all | < 5.4.0-1161.172+fips1 | < 5.15.0-1111.118+fips1 | < 6.8.0-1060.63+fips1

• ubuntu•linux-aws-hwe

  all | < 4.15.0-1194.207~16.04.1

• ubuntu•linux-azure

  all | < 4.15.0-1205.220~14.04.1 | < 4.15.0-1204.219~16.04.1 | all | < 5.4.0-1166.172 | < 5.15.0-1116.125 | < 6.8.0-1063.71 | all | < 7.0.0-1010.10

• ubuntu•linux-azure-4.15

  < 4.15.0-1204.219

• ubuntu•linux-azure-5.11

  all

• ubuntu•linux-azure-5.13

  all

• ubuntu•linux-azure-5.15

  < 5.15.0-1116.125~20.04.1

• ubuntu•linux-azure-5.19

  all

• ubuntu•linux-azure-5.3

  all

• ubuntu•linux-azure-5.4

  < 5.4.0-1166.172~18.04.1

• ubuntu•linux-azure-5.8

  all

• ubuntu•linux-azure-6.11

  all

• ubuntu•linux-azure-6.14

  all

• ubuntu•linux-azure-6.17

  < 6.17.0-1021.21~24.04.1

• ubuntu•linux-azure-6.2

  all

• ubuntu•linux-azure-6.5

  all

• ubuntu•linux-azure-6.8

  < 6.8.0-1063.71~22.04.1

• ubuntu•linux-azure-edge

  all

• ubuntu•linux-azure-fde

  all | all | < 6.8.0-1062.69 | all | < 7.0.0-1009.9

• ubuntu•linux-azure-fde-5.15

  < 5.15.0-1116.125~20.04.1

• ubuntu•linux-azure-fde-5.19

  all

• ubuntu•linux-azure-fde-6.14

  all

Showing first 50 affected entries in server-rendered view.

References (68)

• https://git.kernel.org/stable/c/8d155e2d1c4102f74f82a2bf9c016164bb0f7384
• https://git.kernel.org/stable/c/906f16a836de13fe61f49cdce2f66f2dbd14caf4
• https://git.kernel.org/stable/c/ef8ebb1c637b4cfb61a9dd2e013376774ee2033b
• https://git.kernel.org/stable/c/5e1c4ece08ccdc197177631f111845a2c68eede3
• https://git.kernel.org/stable/c/2ab833a16a825373aad2ba7d54b572b277e95b71
• https://git.kernel.org/stable/c/885c8591784da6314f9aa82fa460ac69f9f79e5f
• https://git.kernel.org/stable/c/324262c38438255bf6bdbf6342ca47c0badaab76
• https://git.kernel.org/stable/c/973f2c250289f5bf6cc146b98aa6fdde11fe50d6
• https://git.kernel.org/stable/c/ce744264b06b97069b3722511ab355738311fee0
• https://access.redhat.com/security/cve/CVE-2026-31607
• https://bugzilla.redhat.com/show_bug.cgi?id=2461521
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31607.json
• https://access.redhat.com/errata/RHSA-2026:25095
• https://access.redhat.com/errata/RHSA-2026:24343
• https://access.redhat.com/errata/RHSA-2026:19569
• https://access.redhat.com/errata/RHSA-2026:23224
• https://access.redhat.com/errata/RHSA-2026:19568
• https://access.redhat.com/errata/RHSA-2026:41236
• https://ubuntu.com/security/CVE-2026-31607
• https://www.cve.org/CVERecord?id=CVE-2026-31607
• https://git.kernel.org/linus/2ab833a16a825373aad2ba7d54b572b277e95b71
• https://ubuntu.com/security/notices/USN-8488-1
• https://ubuntu.com/security/notices/USN-8490-1
• https://ubuntu.com/security/notices/USN-8491-1
• https://ubuntu.com/security/notices/USN-8492-1
• https://ubuntu.com/security/notices/USN-8493-1
• https://ubuntu.com/security/notices/USN-8488-2
• https://ubuntu.com/security/notices/USN-8492-2
• https://ubuntu.com/security/notices/USN-8497-1
• https://ubuntu.com/security/notices/USN-8498-1
• https://ubuntu.com/security/notices/USN-8499-1
• https://ubuntu.com/security/notices/USN-8493-2
• https://ubuntu.com/security/notices/USN-8501-1
• https://ubuntu.com/security/notices/USN-8507-1
• https://ubuntu.com/security/notices/USN-8508-1
• https://ubuntu.com/security/notices/USN-8492-3
• https://ubuntu.com/security/notices/USN-8490-2
• https://ubuntu.com/security/notices/USN-8492-4
• https://ubuntu.com/security/notices/USN-8492-5
• https://ubuntu.com/security/notices/USN-8527-1
• https://ubuntu.com/security/notices/USN-8528-1
• https://ubuntu.com/security/notices/USN-8529-1
• https://ubuntu.com/security/notices/USN-8530-1
• https://ubuntu.com/security/notices/USN-8545-1
• https://ubuntu.com/security/notices/USN-8546-1
• https://ubuntu.com/security/notices/USN-8547-1
• https://ubuntu.com/security/notices/USN-8548-1
• https://ubuntu.com/security/notices/USN-8569-1
• https://ubuntu.com/security/notices/USN-8603-1
• https://ubuntu.com/security/notices/USN-8604-1
• https://ubuntu.com/security/notices/USN-8605-1
• https://ubuntu.com/security/notices/USN-8606-1
• https://ubuntu.com/security/notices/USN-8607-1
• https://ubuntu.com/security/notices/USN-8609-1
• https://ubuntu.com/security/notices/USN-8547-2
• https://ubuntu.com/security/notices/USN-8615-1
• https://ubuntu.com/security/notices/USN-8616-1
• https://ubuntu.com/security/notices/USN-8617-1
• https://ubuntu.com/security/notices/USN-8619-1
• https://ubuntu.com/security/notices/USN-8615-2
• https://ubuntu.com/security/notices/USN-8635-1
• https://security-tracker.debian.org/tracker/CVE-2026-31607
• https://ubuntu.com/security/notices/USN-8529-2
• https://ubuntu.com/security/notices/USN-8530-2
• https://ubuntu.com/security/notices/USN-8548-2
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31607.json
• https://nvd.nist.gov/vuln/detail/CVE-2026-31607
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git