CVE-2026-31616

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: fphonet: fix skb frags[] overflow in pnrx_complete()

A broken/bored/mean USB host can overflow the skbsharedinfo->frags[] array on a Linux gadget exposing a Phonet function by sending an unbounded sequence of full-page OUT transfers.

pnrxcomplete() finalizes the skb only when req->actual < req->length, where req->length is set to PAGESIZE by the gadget. If the host always sends exactly PAGESIZE bytes per transfer, fp->rx.skb will never be reset and each completion will add another fragment via skbaddrxfrag(). Once nrfrags exceeds MAXSKBFRAGS (default 17), subsequent frag stores overwrite memory adjacent to the shinfo on the heap.

Drop the skb and account a length error when the frag limit is reached, matching the fix applied in t7xx by commit f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path").