In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()
The `check_command_size_in_blocks()` function calculates the data size
in bytes by left shifting `common->data_size_from_cmnd` by the block
size (`common->curlun->blkbits`). However, it does not validate whether
this shift operation will cause an integer overflow.
Initially, the block size is set up in `fsg_lun_open()` , and the
`common->data_size_from_cmnd` is set up in `do_scsi_command()`. During
initialization, there is no integer overflow check for the interaction
between two variables.
So if a malicious USB host sends a SCSI READ or WRITE command
requesting a large amount of data (`common->data_size_from_cmnd`), the
left shift operation can wrap around. This results in a truncated data
size, which can bypass boundary checks and potentially lead to memory
corruption or out-of-bounds accesses.
Fix this by using the check_shl_overflow() macro to safely perform the
shift and catch any overflows.
References
Configurations
Configuration 1 (hide)
|
History
20 May 2026, 15:54
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CPE | cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
|
| First Time |
Linux linux Kernel
Linux |
|
| CWE | CWE-190 | |
| References | () https://git.kernel.org/stable/c/228b37936376143f4b60cc6828663f6eaceb81b5 - Patch | |
| References | () https://git.kernel.org/stable/c/3428dc5520c811e66622b2f5fa43341bf9a1f8b3 - Patch | |
| References | () https://git.kernel.org/stable/c/387ebb0453b99d71491419a5dc4ab4bee0cacbac - Patch | |
| References | () https://git.kernel.org/stable/c/8479891d1f04a8ce55366fe4ca361ccdb96f02e1 - Patch | |
| References | () https://git.kernel.org/stable/c/91817ad5452defe69bc7bc0e355f0ed5d01125cc - Patch | |
| References | () https://git.kernel.org/stable/c/ce0caaed5940162780c5c223b8ae54968a5f059b - Patch |
10 Apr 2026, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-10 11:16
Updated : 2026-05-20 15:54
NVD link : CVE-2026-31412
Mitre link : CVE-2026-31412
CVE.ORG link : CVE-2026-31412
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-190
Integer Overflow or Wraparound