Integer overflow in Linux kernel - CVE-2026-31412
Published: April 13, 2026
Vulnerability identifier: #VU125837
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2026-31412
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a remote attacker to cause memory corruption or out-of-bounds access.
The vulnerability exists due to integer overflow in check_command_size_in_blocks() when processing crafted SCSI READ or WRITE commands from a USB host. A remote attacker can send a specially crafted command requesting a large amount of data to cause memory corruption or out-of-bounds access.
The issue occurs because a left shift of the command-derived data size by the logical block size can wrap around and truncate the resulting byte count.
How to mitigate CVE-2026-31412
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/228b37936376143f4b60cc6828663f6eaceb81b5
- https://git.kernel.org/stable/c/3428dc5520c811e66622b2f5fa43341bf9a1f8b3
- https://git.kernel.org/stable/c/387ebb0453b99d71491419a5dc4ab4bee0cacbac
- https://git.kernel.org/stable/c/8479891d1f04a8ce55366fe4ca361ccdb96f02e1
- https://git.kernel.org/stable/c/91817ad5452defe69bc7bc0e355f0ed5d01125cc
- https://git.kernel.org/stable/c/ce0caaed5940162780c5c223b8ae54968a5f059b