CVE-2026-31607

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usbip: validate number_of_packets in usbip_pack_ret_submit()

When a USB/IP client receives a RET_SUBMIT response,

usbip_pack_ret_submit() unconditionally overwrites

urb->number_of_packets from the network PDU. This value is

subsequently used as the loop bound in usbip_recv_iso() and

usbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible

array whose size was fixed at URB allocation time based on the

*original* number_of_packets from the CMD_SUBMIT.

A malicious USB/IP server can set number_of_packets in the response

to a value larger than what was originally submitted, causing a heap

out-of-bounds write when usbip_recv_iso() writes to

urb->iso_frame_desc[i] beyond the allocated region.

KASAN confirmed this with kernel 7.0.0-rc5:

BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640

Write of size 4 at addr ffff888106351d40 by task vhci_rx/69

The buggy address is located 0 bytes to the right o

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References