PT-2026-34968 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-05-06 · CVE-2026-31616

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the USB gadget Phonet function where a USB host can cause an overflow of the skb shared info->frags[] array. This occurs when the host sends an unbounded sequence of full-page OUT transfers. The pn rx complete() function only finalizes the socket buffer (skb) when the actual length is less than the requested length. If the host consistently sends exactly PAGE SIZE bytes, the fp->rx.skb is never reset, and each completion adds a fragment via skb add rx frag(). Once the number of fragments exceeds MAX SKB FRAGS, memory adjacent to the shared information on the heap is overwritten.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-31616

ECHO-C104-483D-7EFB

OPENSUSE-SU-2026:10703-1

Affected Products

Linux Kernel

References · 79

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31616 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31616 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10703-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31616 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31616 · Vendor Advisory
• https://git.kernel.org/stable/c/c9315ce9da3632c591666a29de82d3e92d46bec1 · Patch
• https://git.kernel.org/stable/c/c088d5dd2fffb4de1fb8e7f57751c8b82942180a · Patch
• https://git.kernel.org/stable/c/bd44ce09b9b569f49ed13e2d87d23d853fc7d6a7 · Patch
• https://ubuntu.com/security/CVE-2026-31616 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31616 · Security Note
• https://git.kernel.org/stable/c/9ceff1251904901b0b4e5fe6350fcaffa368ce83 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31616 · Vendor Advisory
• https://git.kernel.org/stable/c/4e476c25bfcab0535ba7c76a903ae77ca8747711 · Patch
• https://git.kernel.org/stable/c/66f7471c4042e4eb300e30b5b9d87d1406862673 · Patch
• https://suse.com/security/cve/CVE-2026-31577 · Note