[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-DEBIAN-CVE-2026-31607":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T03:17:55.401Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":16,"duplicates":17,"related":18,"reserved_at":9,"published_at":19,"modified_at":20,"state":9,"summary":21,"references_raw":23,"kevs":30,"epss":9,"epss_history":31,"metrics":32,"affected":38},"DEBIAN-CVE-2026-31607","In the Linux kernel, the following vulnerability has been resolved:  usbip: validate number_of_packets in usbip_pack_ret_submit()  When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU. This value is subsequently used as the loop bound in usbip_recv_iso() and usbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible array whose size was fixed at URB allocation time based on the *original* number_of_packets from the CMD_SUBMIT.  A malicious USB/IP server can set number_of_packets in the response to a value larger than what was originally submitted, causing a heap out-of-bounds write when usbip_recv_iso() writes to urb->iso_frame_desc[i] beyond the allocated region.  KASAN confirmed this with kernel 7.0.0-rc5:    BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640   Write of size 4 at addr ffff888106351d40 by task vhci_rx/69    The buggy address is located 0 bytes to the right of    allocated 320-byte region [ffff888106351c00, ffff888106351d40)  The server side (stub_rx.c) and gadget side (vudc_rx.c) already validate number_of_packets in the CMD_SUBMIT path since commits c6688ef9f297 (\"usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input\") and b78d830f0049 (\"usbip: fix vudc_rx: harden CMD_SUBMIT path to handle malicious input\"). The server side validates against USBIP_MAX_ISO_PACKETS because no URB exists yet at that point. On the client side we have the original URB, so we can use the tighter bound: the response must not exceed the original number_of_packets.  This mirrors the existing validation of actual_length against transfer_buffer_length in usbip_recv_xbuff(), which checks the response value against the original allocation size.  Kelvin Mbogo's series (\"usb: usbip: fix integer overflow in usbip_recv_iso()\", v2) hardens the receive-side functions themselves; this patch complements that work by catching the bad value at its source -- in usbip_pack_ret_submit() before the overwrite -- and using the tighter per-URB allocation bound rather than the global USBIP_MAX_ISO_PACKETS limit.  Fix this by checking rpdu->number_of_packets against urb->number_of_packets in usbip_pack_ret_submit() before the overwrite. On violation, clamp to zero so that usbip_recv_iso() and usbip_pad_iso() safely return early.",null,[],[],[],[14],{"_key":15},"CVE-2026-31607",[],[],[],"2026-04-24T15:16:39.940Z","2026-07-05T20:00:17.141800233Z",{"cisa_kev":22,"cisa_ransomware":22,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[24],{"url":25,"sources":26,"tags":28},"https://security-tracker.debian.org/tracker/CVE-2026-31607",[27],"osv_debian",[29],"Advisory",[],[],[33],{"source":27,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":34,"cvss_v4_0":9},{"baseScore":35,"baseSeverity":9,"vectorString":36,"impactScore":35,"exploitabilityScore":37},9.8,"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",10,[39,65],{"ecosystem":40,"name":41,"vendor":42,"product":41,"cpe_part":9,"purl_type":43,"purl_namespace":42,"purl_name":41,"source":9,"versions":44},"Debian","linux","debian","deb",[45,49,50,51,52,56,59,62],{"version":46,"is_range":47,"range_type":48,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"version":46,"is_range":47,"range_type":48,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":46,"is_range":47,"range_type":48,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":46,"is_range":47,"range_type":48,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":53,"is_range":47,"range_type":48,"version_start":9,"version_start_type":9,"version_end":54,"version_end_type":55,"fixed_in":9},"lt5_10_259_1","5.10.259-1","excluding",{"version":57,"is_range":47,"range_type":48,"version_start":9,"version_start_type":9,"version_end":58,"version_end_type":55,"fixed_in":9},"lt6_1_176_1","6.1.176-1",{"version":60,"is_range":47,"range_type":48,"version_start":9,"version_start_type":9,"version_end":61,"version_end_type":55,"fixed_in":9},"lt6_12_85_1","6.12.85-1",{"version":63,"is_range":47,"range_type":48,"version_start":9,"version_start_type":9,"version_end":64,"version_end_type":55,"fixed_in":9},"lt6_19_14_1","6.19.14-1",{"ecosystem":40,"name":66,"vendor":42,"product":66,"cpe_part":9,"purl_type":43,"purl_namespace":42,"purl_name":66,"source":9,"versions":67},"linux-6.1",[68],{"version":69,"is_range":47,"range_type":48,"version_start":9,"version_start_type":9,"version_end":70,"version_end_type":55,"fixed_in":9},"lt6_1_176_1~deb11u1","6.1.176-1~deb11u1"]