PT-2026-31909 · Linux · Linux
Published
2026-04-10
·
Updated
2026-04-10
·
CVE-2026-31412
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f mass storage: Fix potential integer overflow in check command size in blocks()
The
check command size in blocks() function calculates the data size
in bytes by left shifting common->data size from cmnd by the block
size (common->curlun->blkbits). However, it does not validate whether
this shift operation will cause an integer overflow.Initially, the block size is set up in
fsg lun open() , and the
common->data size from cmnd is set up in do scsi command(). During
initialization, there is no integer overflow check for the interaction
between two variables.So if a malicious USB host sends a SCSI READ or WRITE command
requesting a large amount of data (
common->data size from cmnd), the
left shift operation can wrap around. This results in a truncated data
size, which can bypass boundary checks and potentially lead to memory
corruption or out-of-bounds accesses.Fix this by using the check shl overflow() macro to safely perform the
shift and catch any overflows.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux