CVE-2026-31616: usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: fphonet: fix skb frags[] overflow in pnrxcomplete()
A broken/bored/mean USB host can overflow the skbsharedinfo->frags[] array on a Linux gadget exposing a Phonet function by sending an unbounded sequence of full-page OUT transfers.
pnrxcomplete() finalizes the skb only when req->actual < req->length, where req->length is set to PAGESIZE by the gadget. If the host always sends exactly PAGESIZE bytes per transfer, fp->rx.skb will never be reset and each completion will add another fragment via skbaddrxfrag(). Once nrfrags exceeds MAXSKBFRAGS (default 17), subsequent frag stores overwrite memory adjacent to the shinfo on the heap.
Drop the skb and account a length error when the frag limit is reached, matching the fix applied in t7xx by commit f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
Linux kernel usb gadget f_phonetto a version that resolves this vulnerability.Patch f0813bcd2d9d
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31616?
CVE-2026-31616 is considered a high severity vulnerability due to its potential to allow a malicious USB host to cause an overflow in the skb_shared_info's frags array.
How do I fix CVE-2026-31616?
To fix CVE-2026-31616, update the Linux kernel and ensure you are using a patched version that addresses the skb frags array overflow issue.
What type of systems are affected by CVE-2026-31616?
CVE-2026-31616 affects Linux kernel systems utilizing the usb gadget f_phonet feature.
What is the impact of CVE-2026-31616?
The impact of CVE-2026-31616 includes potential system instability or crashes due to buffer overflow caused by malicious USB hosts.
When was CVE-2026-31616 disclosed?
CVE-2026-31616 was disclosed in 2026 as part of ongoing security updates to the Linux kernel.