CVE-2026-31616
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() A broken/bored/mean USB host can overflow the skb_shared_info->frags[] array on a Linux gadget exposing a Phonet function by sending an unbounded sequence of full-page OUT transfers. pn_rx_complete() finalizes the skb only when req->actual < req->length, where req->length is set to PAGE_SIZE by the gadget. If the host always sends exactly PAGE_SIZE bytes per transfer, fp->rx.skb will never be reset and each completion will add another fragment via skb_add_rx_frag(). Once nr_frags exceeds MAX_SKB_FRAGS (default 17), subsequent frag stores overwrite memory adjacent to the shinfo on the heap. Drop the skb and account a length error when the frag limit is reached, matching the fix applied in t7xx by commit f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path").
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| b91cd1440870f7a0649e570498b7b93caf9f781c | affected | git | 3d7f7e0c842242878c24b2facff8d6eda23ee1e9 | Unavailable | None listed |
| b91cd1440870f7a0649e570498b7b93caf9f781c | affected | git | b5ec49fa198bd08967a3102bd41f53ccadce72c9 | Unavailable | None listed |
| b91cd1440870f7a0649e570498b7b93caf9f781c | affected | git | 7424f0287da73d3d8c5fa5e9d25d26fce762708e | Unavailable | None listed |
| b91cd1440870f7a0649e570498b7b93caf9f781c | affected | git | 9ceff1251904901b0b4e5fe6350fcaffa368ce83 | Unavailable | None listed |
| b91cd1440870f7a0649e570498b7b93caf9f781c | affected | git | c9315ce9da3632c591666a29de82d3e92d46bec1 | Unavailable | None listed |
| b91cd1440870f7a0649e570498b7b93caf9f781c | affected | git | 4e476c25bfcab0535ba7c76a903ae77ca8747711 | Unavailable | None listed |
| b91cd1440870f7a0649e570498b7b93caf9f781c | affected | git | bd44ce09b9b569f49ed13e2d87d23d853fc7d6a7 | Unavailable | None listed |
| b91cd1440870f7a0649e570498b7b93caf9f781c | affected | git | 66f7471c4042e4eb300e30b5b9d87d1406862673 | Unavailable | None listed |
| b91cd1440870f7a0649e570498b7b93caf9f781c | affected | git | c088d5dd2fffb4de1fb8e7f57751c8b82942180a | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.6.32 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 2.6.32 | Unavailable | None listed |
| 5.10.258 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.209 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.175 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.136 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.83 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.24 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 6.19.14 | unaffected | semver | Unavailable | 6.19.* | None listed |
| 7.0.1 | unaffected | semver | Unavailable | 7.0.* | None listed |
| 7.1 | unaffected | original_commit_for_fix | Unavailable | * | None listed |