GHSA-PMXH-4W53-FP85

Vulnerability from github – Published: 2026-05-01 15:30 – Updated: 2026-05-01 15:30
VLAI?
Details

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_uac1_legacy: validate control request size

f_audio_complete() copies req->length bytes into a 4-byte stack variable:

u32 data = 0; memcpy(&data, req->buf, req->length);

req->length is derived from the host-controlled USB request path, which can lead to a stack out-of-bounds write.

Validate req->actual against the expected payload size for the supported control selectors and decode only the expected amount of data.

This avoids copying a host-influenced length into a fixed-size stack object.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-31720"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-01T15:16:34Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_uac1_legacy: validate control request size\n\nf_audio_complete() copies req-\u003elength bytes into a 4-byte stack\nvariable:\n\n  u32 data = 0;\n  memcpy(\u0026data, req-\u003ebuf, req-\u003elength);\n\nreq-\u003elength is derived from the host-controlled USB request path,\nwhich can lead to a stack out-of-bounds write.\n\nValidate req-\u003eactual against the expected payload size for the\nsupported control selectors and decode only the expected amount\nof data.\n\nThis avoids copying a host-influenced length into a fixed-size\nstack object.",
  "id": "GHSA-pmxh-4w53-fp85",
  "modified": "2026-05-01T15:30:33Z",
  "published": "2026-05-01T15:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31720"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0d41772d98dcaf6c17e875b7d0ea0154ae1191ee"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/21b11e8581285c6f10ef43d05df349d445f24273"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/26304d124e7f0383f8fe1168b5801a0ac7e16b1c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/557d1d4e862eccd0b74cc377b66de3e1e8d49605"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6e0e34d85cd46ceb37d16054e97a373a32770f6c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8e5eb1d6e6a3d7bbea9c92132d0cda5793176426"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/be2d32f0c3fe333d14c0a9ca90328dacbc3e06b8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c6da4fed7537aec19880c24f6c3a95065adb1406"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.