Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-31412— usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于check_command_size_in_blocks函数中整数溢出问题，可能导致内存损坏或越界访问。

AI Predicted 7.8 Difficulty: Easy EPSS 0.17% · P6

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux 144974e7f9e32b53b02f6c8632be45d8f43d6ab5< 91817ad5452defe69bc7bc0e355f0ed5d01125cc affected
144974e7f9e32b53b02f6c8632be45d8f43d6ab5< ce0caaed5940162780c5c223b8ae54968a5f059b affected
144974e7f9e32b53b02f6c8632be45d8f43d6ab5< 228b37936376143f4b60cc6828663f6eaceb81b5 affected
144974e7f9e32b53b02f6c8632be45d8f43d6ab5< 3428dc5520c811e66622b2f5fa43341bf9a1f8b3 affected
144974e7f9e32b53b02f6c8632be45d8f43d6ab5< 387ebb0453b99d71491419a5dc4ab4bee0cacbac affected
144974e7f9e32b53b02f6c8632be45d8f43d6ab5< 8479891d1f04a8ce55366fe4ca361ccdb96f02e1 affected
3.3 affected
< 3.3 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-31412

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() The `check_command_size_in_blocks()` function calculates the data size in bytes by left shifting `common->data_size_from_cmnd` by the block size (`common->curlun->blkbits`). However, it does not validate whether this shift operation will cause an integer overflow. Initially, the block size is set up in `fsg_lun_open()` , and the `common->data_size_from_cmnd` is set up in `do_scsi_command()`. During initialization, there is no integer overflow check for the interaction between two variables. So if a malicious USB host sends a SCSI READ or WRITE command requesting a large amount of data (`common->data_size_from_cmnd`), the left shift operation can wrap around. This results in a truncated data size, which can bypass boundary checks and potentially lead to memory corruption or out-of-bounds accesses. Fix this by using the check_shl_overflow() macro to safely perform the shift and catch any overflows.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于check_command_size_in_blocks函数中整数溢出问题，可能导致内存损坏或越界访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 144974e7f9e32b53b02f6c8632be45d8f43d6ab5 ~ 91817ad5452defe69bc7bc0e355f0ed5d01125cc -
Linux Linux 3.3 -

II. Public POCs for CVE-2026-31412

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31412

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-31412 (6)

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31412

No comments yet

Leave a comment