SB20260425114 - Heap-based buffer overflow in Linux kernel usb usbip driver

Description

This security bulletin contains information about 1 vulnerability.

1) Heap-based buffer overflow (CVE-ID: CVE-2026-31607)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in usbip_pack_ret_submit() when processing a RET_SUBMIT response from a USB/IP server. A remote attacker can send a specially crafted response with an oversized number_of_packets value to cause a denial of service or execute arbitrary code.

The issue occurs because the response value is later used as the loop bound for accesses to urb->iso_frame_desc[], whose allocation size was determined by the original submission.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5e1c4ece08ccdc197177631f111845a2c68eede3
• https://git.kernel.org/stable/c/8d155e2d1c4102f74f82a2bf9c016164bb0f7384
• https://git.kernel.org/stable/c/906f16a836de13fe61f49cdce2f66f2dbd14caf4
• https://git.kernel.org/stable/c/ef8ebb1c637b4cfb61a9dd2e013376774ee2033b