CVE-2026-31607: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31607 Overview

CVE-2026-31607 is a heap out-of-bounds write vulnerability in the Linux kernel's USB/IP client implementation. The flaw resides in the usbip_pack_ret_submit() function, which unconditionally overwrites urb->number_of_packets with a value supplied by a remote USB/IP server. This attacker-controlled value is later used as a loop bound in usbip_recv_iso() and usbip_pad_iso() when iterating over urb->iso_frame_desc[], a flexible array sized at allocation time based on the original CMD_SUBMIT packet count. A malicious USB/IP server can return a larger number_of_packets than originally submitted, triggering an out-of-bounds write [CWE-787] into adjacent heap memory.

Critical Impact
A malicious USB/IP server can write past an allocated 320-byte heap region on a connected client, enabling potential remote code execution or kernel memory corruption against any system running the vulnerable vhci_hcd driver.

Affected Products

Linux Kernel (USB/IP client subsystem, drivers/usb/usbip/)
Systems loading the vhci_hcd module and connecting to remote USB/IP servers
Multiple stable kernel branches addressed via backport commits

Discovery Timeline

2026-04-24 - CVE-2026-31607 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31607

Vulnerability Analysis

The USB/IP protocol allows USB devices to be shared over a network. On the client side, when a RET_SUBMIT response arrives from a remote server, the usbip_pack_ret_submit() function unpacks the network protocol data unit (PDU) and copies fields into the local URB structure. The function overwrites urb->number_of_packets with the value from the network response without verifying it against the originally submitted value.

The urb->iso_frame_desc[] array is a flexible array member allocated when the URB was first created, sized according to the number_of_packets value in the original CMD_SUBMIT. Once the attacker-controlled response value replaces the original count, downstream iteration in usbip_recv_iso() and usbip_pad_iso() walks past the allocated region.

KASAN instrumentation confirmed the issue with a slab-out-of-bounds write of 4 bytes at offset 0 past a 320-byte allocation, triggered by the vhci_rx kernel thread. The write primitive sits inside isochronous frame descriptor processing, giving an attacker a controllable heap corruption channel.

Root Cause

The root cause is missing input validation on a length field received from an untrusted network peer. While the server-side (stub_rx.c) and gadget-side (vudc_rx.c) CMD_SUBMIT paths were previously hardened in commits c6688ef9f297 and b78d830f0049, the client-side RET_SUBMIT path retained the unchecked overwrite. The client has access to the original URB and can apply a tighter per-URB bound than the global USBIP_MAX_ISO_PACKETS limit.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond the victim system being attached to a remote USB/IP server. An attacker controlling a malicious or compromised USB/IP server crafts a RET_SUBMIT PDU containing a number_of_packets value larger than the original CMD_SUBMIT count. When the client processes the response, the resulting out-of-bounds write into kernel slab memory can corrupt adjacent objects.

The exploit primitive is triggered along the following call chain on a vulnerable client:

  vhci_rx (kernel thread)
    -> usbip_pack(..., rpdu, 0)        // RET_SUBMIT unpack
      -> usbip_pack_ret_submit()       // attacker value overwrites urb->number_of_packets
    -> usbip_recv_iso(ud, urb)         // iterates 0..urb->number_of_packets
      -> writes to urb->iso_frame_desc[i] past allocation -> heap OOB write

No verified public proof-of-concept code is available. See the kernel
commits referenced in the patch information section for technical detail.

Detection Methods for CVE-2026-31607

Indicators of Compromise

KASAN reports of slab-out-of-bounds writes originating from usbip_recv_iso+0x46a/0x640 or usbip_pad_iso in kernel logs
Unexpected vhci_rx thread crashes or kernel oops events on systems using USB/IP
USB/IP client sessions established to unknown or untrusted remote server addresses

Detection Strategies

Audit running kernels for the presence and load state of the vhci_hcd module on workstations and servers
Inspect network telemetry for outbound TCP connections to USB/IP default port 3240 from non-approved hosts
Correlate kernel log anomalies (oops, BUG, KASAN traces referencing usbip_) with USB/IP session activity

Monitoring Recommendations

Enable kernel audit logging for module loads and flag any load of vhci_hcd in environments where USB/IP is not required
Collect and centralize dmesg and journald output to detect post-exploitation kernel instability
Monitor for usbip attach command execution and unauthorized changes to USB/IP configuration files

How to Mitigate CVE-2026-31607

Immediate Actions Required

Apply the upstream kernel patches referenced in the kernel.org commits listed below to all affected systems
Unload the vhci_hcd module on systems that do not require USB/IP client functionality using modprobe -r vhci_hcd
Restrict USB/IP client connections to trusted, authenticated server endpoints on isolated network segments

Patch Information

The fix validates rpdu->number_of_packets against the original urb->number_of_packets inside usbip_pack_ret_submit() before the overwrite. On violation, the value is clamped to zero so that usbip_recv_iso() and usbip_pad_iso() return early without iterating. Patch commits are available from kernel.org: Kernel Git Commit 2ab833a, Kernel Git Commit 5e1c4ec, Kernel Git Commit 885c859, Kernel Git Commit 8d155e2, Kernel Git Commit 906f16a, and Kernel Git Commit ef8ebb1.

Workarounds

Blacklist the vhci_hcd module via /etc/modprobe.d/ to prevent USB/IP client functionality from loading
Block outbound TCP port 3240 at the host or network firewall where USB/IP is not an operational requirement
Limit USB/IP usage to lab environments isolated from production networks until patches are deployed

bash

# Blacklist the vhci_hcd module to disable the USB/IP client path
echo "blacklist vhci_hcd" | sudo tee /etc/modprobe.d/disable-usbip.conf
sudo modprobe -r vhci_hcd 2>/dev/null || true

# Block outbound USB/IP traffic (default port 3240) at the host firewall
sudo iptables -A OUTPUT -p tcp --dport 3240 -j DROP