CVE-2026-31623: net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
In the Linux kernel, the following vulnerability has been resolved:
net: usb: cdc-phonet: fix skb frags[] overflow in rxcomplete()
A malicious USB device claiming to be a CDC Phonet modem can overflow the skbsharedinfo->frags[] array by sending an unbounded sequence of full-page bulk transfers.
Drop the skb and increment the length error when the frag limit is reached. This matches the same fix that commit f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path") did for the t7xx driver.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.137.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In the CDC Phonet rx_complete() path, drop the skb and increment the length error when the skb fragment limit is reached.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using the Linux kernel cdc-phonet USB networking driver are exposed when they can be connected to a malicious USB device that presents itself as a CDC Phonet modem. The listed affected software includes Linux kernel cdc-phonet and Microsoft azl3 kernel 6.6.134.1-2.
What does an attacker need to exploit it?
An attacker needs to provide a malicious USB device claiming to be a CDC Phonet modem. The device sends an unbounded sequence of full-page bulk transfers, causing an overflow of the skb_shared_info->frags[] array in the receive path.
What should be done to remediate the issue?
Apply the available patch. The fix drops the skb and increments the length error when the fragment limit is reached, preventing the frags[] overflow.