Integer Overflow Vulnerability in Linux Kernel USB Mass Storage Implementation

CVE-2026-31412

What is CVE-2026-31412?

The Linux kernel contains a vulnerability in the USB mass storage gadget where an integer overflow may occur during command processing. The issue originates in the check_command_size_in_blocks() function, which calculates data sizes by left shifting the data_size_from_cmnd variable. If a large data request is issued via a malicious USB host, this shift operation may incorrectly assess the size, potentially leading to memory corruption or out-of-bounds memory access. The problem arises due to the absence of checks during the initialization of critical variables. The vulnerability has been addressed by implementing the check_shl_overflow() macro to prevent such overflow situations.

References