CVE-2026-31623: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31623 Overview

CVE-2026-31623 is a buffer overflow vulnerability in the Linux kernel's cdc-phonet USB network driver. A malicious USB device that claims to be a CDC Phonet modem can overflow the skb_shared_info->frags[] array. The overflow occurs in rx_complete() when the device sends an unbounded sequence of full-page bulk transfers. The flaw is tracked under [CWE-120] (Classic Buffer Overflow) and affects the Linux kernel USB subsystem. Exploitation requires physical access or a malicious peripheral attached to the host, which limits remote exposure but enables denial-of-service against any system that auto-binds the driver.

Critical Impact
A malicious USB device can corrupt kernel memory by overflowing the frags[] array, leading to a high-impact denial-of-service condition against the host.

Affected Products

Linux Kernel (multiple stable branches, see kernel.org commits)
Systems with the cdc-phonet USB driver compiled or loadable
Hosts that auto-probe USB CDC Phonet class devices

Discovery Timeline

2026-04-24 - CVE-2026-31623 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31623

Vulnerability Analysis

The vulnerability resides in the receive completion handler rx_complete() within the net/usb/cdc-phonet.c driver. The handler accumulates incoming bulk transfer pages into the skb_shared_info->frags[] array of a socket buffer. The original code did not bound the number of fragments appended per skb. A USB device that continuously delivers full-page bulk transfers can push the fragment count beyond MAX_SKB_FRAGS, writing past the end of the fixed-size frags[] array. The resulting out-of-bounds write corrupts adjacent kernel memory structures.

The fix mirrors commit f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path"), which addressed an equivalent condition in the t7xx driver. When the fragment limit is reached, the driver now drops the skb and increments the length error counter rather than appending another fragment.

Root Cause

The root cause is missing boundary validation on the fragment count in the receive path. The driver trusted device-supplied transfer sequences and appended each completed page to frags[] without comparing the current fragment index against MAX_SKB_FRAGS. This is a classic input-validation failure on data sourced from an untrusted peripheral.

Attack Vector

An attacker connects a malicious USB device that advertises the CDC Phonet class. Once the kernel binds cdc-phonet, the device issues continuous full-page bulk-IN transfers without sending an end-of-message marker. The receive completion handler keeps growing a single skb until the frags[] array overflows, triggering memory corruption and a kernel crash.

Exploitation requires local proximity or a compromised USB peripheral. No user interaction beyond connecting the device is required. The CVSS vector indicates impact limited to availability, consistent with a kernel panic outcome.

The vulnerability is described in prose only because no public proof-of-concept code is available. See the kernel.org stable commits for the patch implementation.

Detection Methods for CVE-2026-31623

Indicators of Compromise

Kernel oops or panic messages referencing rx_complete or cdc_phonet in dmesg and /var/log/kern.log
Sudden network interface teardown coinciding with USB device enumeration events
udev logs showing repeated bind/unbind of a CDC Phonet class device

Detection Strategies

Monitor kernel ring buffer entries for skb_shared_info corruption signatures and slab allocator warnings
Alert on USB device class 0x02 (Communications) subclass Phonet enumeration on systems that do not legitimately use Phonet modems
Correlate USB hotplug events with subsequent kernel crashes through centralized syslog ingestion

Monitoring Recommendations

Ingest auditd USB device events and kern.* facility logs into a centralized SIEM for correlation
Track loaded kernel modules across the fleet and flag systems with cdc_phonet present in lsmod output
Enable kernel hardening features such as KASAN in test environments to surface fragment overflow attempts during validation

How to Mitigate CVE-2026-31623

Immediate Actions Required

Apply the upstream kernel patches referenced in the kernel.org stable tree commits
Blacklist the cdc_phonet module on systems that do not require Phonet modem support
Restrict physical USB access on servers, kiosks, and unattended endpoints
Enable USBGuard or equivalent policy enforcement to whitelist authorized USB device classes

Patch Information

The fix is committed across multiple stable branches. See Kernel Git Commit 600dc40, Kernel Git Commit 9989938, Kernel Git Commit a23b1b1, Kernel Git Commit c183d57, Kernel Git Commit d4e1946, and Kernel Git Commit ebf75c6. The patch adds a fragment count check in rx_complete() that drops the skb and increments the length error counter when MAX_SKB_FRAGS is reached.

Workarounds

Unload the driver with modprobe -r cdc_phonet and blacklist it via /etc/modprobe.d/blacklist-cdc-phonet.conf
Deploy USBGuard policies that reject CDC Phonet class devices on production hosts
Disable USB ports through BIOS/UEFI settings on systems that do not require peripheral connectivity

bash

# Configuration example
# Blacklist the cdc_phonet module
echo "blacklist cdc_phonet" | sudo tee /etc/modprobe.d/blacklist-cdc-phonet.conf
sudo modprobe -r cdc_phonet
sudo update-initramfs -u