CVE-2026-31607
- Source
- https://cve.org/CVERecord?id=CVE-2026-31607
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31607.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-31607
- Downstream
- Related
- Published
- 2026-04-24T14:42:29.468Z
- Modified
- 2026-06-10T18:29:14.708150130Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- usbip: validate number_of_packets in usbip_pack_ret_submit()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
usbip: validate numberofpackets in usbippackret_submit()
When a USB/IP client receives a RETSUBMIT response, usbippackretsubmit() unconditionally overwrites urb->numberofpackets from the network PDU. This value is subsequently used as the loop bound in usbiprecviso() and usbippadiso() to iterate over urb->isoframedesc[], a flexible array whose size was fixed at URB allocation time based on the original numberofpackets from the CMD_SUBMIT.
A malicious USB/IP server can set numberofpackets in the response to a value larger than what was originally submitted, causing a heap out-of-bounds write when usbiprecviso() writes to urb->isoframedesc[i] beyond the allocated region.
KASAN confirmed this with kernel 7.0.0-rc5:
BUG: KASAN: slab-out-of-bounds in usbiprecviso+0x46a/0x640 Write of size 4 at addr ffff888106351d40 by task vhci_rx/69
The buggy address is located 0 bytes to the right of allocated 320-byte region [ffff888106351c00, ffff888106351d40)
The server side (stubrx.c) and gadget side (vudcrx.c) already validate numberofpackets in the CMDSUBMIT path since commits c6688ef9f297 ("usbip: fix stubrx: harden CMDSUBMIT path to handle malicious input") and b78d830f0049 ("usbip: fix vudcrx: harden CMDSUBMIT path to handle malicious input"). The server side validates against USBIPMAXISOPACKETS because no URB exists yet at that point. On the client side we have the original URB, so we can use the tighter bound: the response must not exceed the original numberofpackets.
This mirrors the existing validation of actuallength against transferbufferlength in usbiprecv_xbuff(), which checks the response value against the original allocation size.
Kelvin Mbogo's series ("usb: usbip: fix integer overflow in usbiprecviso()", v2) hardens the receive-side functions themselves; this patch complements that work by catching the bad value at its source -- in usbippackretsubmit() before the overwrite -- and using the tighter per-URB allocation bound rather than the global USBIPMAXISOPACKETS limit.
Fix this by checking rpdu->numberofpackets against urb->numberofpackets in usbippackretsubmit() before the overwrite. On violation, clamp to zero so that usbiprecviso() and usbippad_iso() safely return early.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31607.json" }- References
-
- https://git.kernel.org/stable/c/2ab833a16a825373aad2ba7d54b572b277e95b71
- https://git.kernel.org/stable/c/5e1c4ece08ccdc197177631f111845a2c68eede3
- https://git.kernel.org/stable/c/885c8591784da6314f9aa82fa460ac69f9f79e5f
- https://git.kernel.org/stable/c/8d155e2d1c4102f74f82a2bf9c016164bb0f7384
- https://git.kernel.org/stable/c/906f16a836de13fe61f49cdce2f66f2dbd14caf4
- https://git.kernel.org/stable/c/ef8ebb1c637b4cfb61a9dd2e013376774ee2033b
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31607.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-31607
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1325f85fa49f57df034869de430f7c302ae23109Fixed885c8591784da6314f9aa82fa460ac69f9f79e5fFixed8d155e2d1c4102f74f82a2bf9c016164bb0f7384Fixed906f16a836de13fe61f49cdce2f66f2dbd14caf4Fixedef8ebb1c637b4cfb61a9dd2e013376774ee2033bFixed5e1c4ece08ccdc197177631f111845a2c68eede3Fixed2ab833a16a825373aad2ba7d54b572b277e95b71
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedd9638d9236eed035a575feddec61d036dacc2676Last affectedca7d3501b7a287c18b5b470e871d3029b0f4842aLast affected1ce528277e1a66856ed3f7526c1e3458c0ed4a70Last affecteddb898d0c5c493ce4177d5e1d3a953e079a56a24bLast affected5aa02704b9ee67c5b2ee26d54c5f4eb99e93ba9a