SB20260425106 - Out-of-bounds write in Linux kernel gadget function driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-31616)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in pn_rx_complete() when processing an unbounded sequence of full-page USB OUT transfers. A remote attacker can send a crafted sequence of full-page USB OUT transfers to cause memory corruption.

The issue affects a Linux gadget exposing a Phonet function and occurs when each transfer is exactly PAGE_SIZE bytes, preventing the skb from being reset.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4e476c25bfcab0535ba7c76a903ae77ca8747711
• https://git.kernel.org/stable/c/66f7471c4042e4eb300e30b5b9d87d1406862673
• https://git.kernel.org/stable/c/bd44ce09b9b569f49ed13e2d87d23d853fc7d6a7
• https://git.kernel.org/stable/c/c9315ce9da3632c591666a29de82d3e92d46bec1