Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-31607— usbip: validate number_of_packets in usbip_pack_ret_submit()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于usbip驱动usbip_pack_ret_submit()未验证number_of_packets值，恶意服务器可设置过大值导致堆越界写入。

CVSS 9.8 · Critical EPSS 0.31% · P23

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 30

VendorProduct Version RangeStatus
Linux Linux 1325f85fa49f57df034869de430f7c302ae23109< 324262c38438255bf6bdbf6342ca47c0badaab76 affected
1325f85fa49f57df034869de430f7c302ae23109< 973f2c250289f5bf6cc146b98aa6fdde11fe50d6 affected
1325f85fa49f57df034869de430f7c302ae23109< ce744264b06b97069b3722511ab355738311fee0 affected
1325f85fa49f57df034869de430f7c302ae23109< 885c8591784da6314f9aa82fa460ac69f9f79e5f affected
1325f85fa49f57df034869de430f7c302ae23109< 8d155e2d1c4102f74f82a2bf9c016164bb0f7384 affected
1325f85fa49f57df034869de430f7c302ae23109< 906f16a836de13fe61f49cdce2f66f2dbd14caf4 affected
1325f85fa49f57df034869de430f7c302ae23109< ef8ebb1c637b4cfb61a9dd2e013376774ee2033b affected
1325f85fa49f57df034869de430f7c302ae23109< 5e1c4ece08ccdc197177631f111845a2c68eede3 affected
… +22 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-31607

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
usbip: validate number_of_packets in usbip_pack_ret_submit()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU. This value is subsequently used as the loop bound in usbip_recv_iso() and usbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible array whose size was fixed at URB allocation time based on the *original* number_of_packets from the CMD_SUBMIT. A malicious USB/IP server can set number_of_packets in the response to a value larger than what was originally submitted, causing a heap out-of-bounds write when usbip_recv_iso() writes to urb->iso_frame_desc[i] beyond the allocated region. KASAN confirmed this with kernel 7.0.0-rc5: BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640 Write of size 4 at addr ffff888106351d40 by task vhci_rx/69 The buggy address is located 0 bytes to the right of allocated 320-byte region [ffff888106351c00, ffff888106351d40) The server side (stub_rx.c) and gadget side (vudc_rx.c) already validate number_of_packets in the CMD_SUBMIT path since commits c6688ef9f297 ("usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input") and b78d830f0049 ("usbip: fix vudc_rx: harden CMD_SUBMIT path to handle malicious input"). The server side validates against USBIP_MAX_ISO_PACKETS because no URB exists yet at that point. On the client side we have the original URB, so we can use the tighter bound: the response must not exceed the original number_of_packets. This mirrors the existing validation of actual_length against transfer_buffer_length in usbip_recv_xbuff(), which checks the response value against the original allocation size. Kelvin Mbogo's series ("usb: usbip: fix integer overflow in usbip_recv_iso()", v2) hardens the receive-side functions themselves; this patch complements that work by catching the bad value at its source -- in usbip_pack_ret_submit() before the overwrite -- and using the tighter per-URB allocation bound rather than the global USBIP_MAX_ISO_PACKETS limit. Fix this by checking rpdu->number_of_packets against urb->number_of_packets in usbip_pack_ret_submit() before the overwrite. On violation, clamp to zero so that usbip_recv_iso() and usbip_pad_iso() safely return early.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于usbip驱动usbip_pack_ret_submit()未验证number_of_packets值，恶意服务器可设置过大值导致堆越界写入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1325f85fa49f57df034869de430f7c302ae23109 ~ 324262c38438255bf6bdbf6342ca47c0badaab76 -
Linux Linux 2.6.39 -

II. Public POCs for CVE-2026-31607

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31607

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-31607 (5)

Same Patch Batch · Linux · 2026-04-24 · 138 CVEs total

CVE-2026-31637 9.8 CRITICAL rxrpc: reject undecryptable rxkad response tickets
CVE-2026-31589 9.8 CRITICAL mm: call ->free_folio() directly in folio_unmap_invalidate()
CVE-2026-31536 9.8 CRITICAL smb: server: let send_done handle a completion without IB_SEND_SIGNALED
CVE-2026-31649 9.8 CRITICAL net: stmmac: fix integer underflow in chain mode
CVE-2026-31669 9.8 CRITICAL mptcp: fix slab-use-after-free in __inet_lookup_established
CVE-2026-31668 9.8 CRITICAL seg6: separate dst_cache for input and output paths in seg6 lwtunnel
CVE-2026-31608 9.8 CRITICAL smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list
CVE-2026-31633 9.8 CRITICAL rxrpc: Fix integer overflow in rxgk_verify_response()
CVE-2026-31609 9.8 CRITICAL smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()
CVE-2026-31657 9.8 CRITICAL batman-adv: hold claim backbone gateways by reference
CVE-2026-31659 9.8 CRITICAL batman-adv: reject oversized global TT response buffers
CVE-2026-31636 9.1 CRITICAL rxrpc: fix RESPONSE authenticator parser OOB read
CVE-2026-31588 8.8 HIGH KVM: x86: Use scratch field in MMIO fragment to hold small write values
CVE-2026-31570 8.8 HIGH can: gw: fix OOB heap access in cgw_csum_crc8_rel()
CVE-2026-31558 8.8 HIGH LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust
CVE-2026-31553 8.8 HIGH KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
CVE-2026-31622 8.8 HIGH NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
CVE-2026-31629 8.8 HIGH nfc: llcp: add missing return after LLCP_CLOSED checks
CVE-2026-31611 8.6 HIGH ksmbd: require 3 sub-authorities before reading sub_auth[2]
CVE-2026-31631 8.2 HIGH rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()

Showing top 20 of 138 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31607

No comments yet

Leave a comment