CVE-2026-31412: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31412 is an integer overflow vulnerability in the Linux kernel's USB mass storage gadget driver (f_mass_storage), specifically in the check_command_size_in_blocks() function. A malicious USB host can send crafted SCSI READ or WRITE commands to trigger an integer wraparound, potentially leading to memory corruption or out-of-bounds memory accesses. The vulnerability affects Linux kernel versions from 3.3 up to (but not including) 6.1.167, 6.2–6.6.130, 6.7–6.12.78, 6.13–6.18.19, and 6.19–6.19.9, as well as 7.0-rc1 through 7.0-rc3. It was published on April 10, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-1335 (Incorrect Bitwise Shift of Integer) and CWE-190 (Integer Overflow or Wraparound). In check_command_size_in_blocks(), the data size in bytes is computed by left-shifting common->data_size_from_cmnd by common->curlun->blkbits (the block size), without any validation that the shift will not overflow. The block size is initialized in fsg_lun_open() and the command data size is set in do_scsi_command(), with no overflow guard at the interaction point between these two values. If a malicious USB host sends a SCSI command with a sufficiently large data_size_from_cmnd, the left shift wraps around, producing a truncated byte count that bypasses boundary checks and can lead to out-of-bounds memory accesses (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can result in memory corruption or out-of-bounds memory accesses on the affected Linux system, primarily impacting availability (kernel crash or instability). Confidentiality and integrity impacts are not directly indicated by the CVSS scoring, but memory corruption primitives can in some scenarios be chained for further exploitation. The attack requires physical or logical access as a USB host to a device running the Linux USB mass storage gadget, limiting the scope to systems where this gadget functionality is enabled (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), reflecting a very low probability of exploitation in the near term. Exploitation requires the attacker to act as a USB host connected to a target device with the mass storage gadget enabled, which is a significant physical or logical access precondition.

1. Identify target: Locate a Linux system with the USB mass storage gadget (f_mass_storage) enabled and running a vulnerable kernel version (3.3 through 6.1.166, 6.2–6.6.129, 6.7–6.12.77, 6.13–6.18.18, or 6.19–6.19.8).
2. Connect as USB host: Attach a malicious USB host device (e.g., a custom USB controller or a modified USB gadget emulator) to the target system's USB device port.
3. Craft malicious SCSI command: Prepare a SCSI READ or WRITE command with an abnormally large data_size_from_cmnd value designed to cause an integer overflow when left-shifted by the block size (blkbits) in check_command_size_in_blocks().
4. Send command: Transmit the crafted SCSI command to the target. The left shift operation wraps around, producing a truncated data size that bypasses boundary checks.
5. Trigger memory corruption: The truncated size causes the kernel to perform out-of-bounds memory accesses, potentially resulting in a kernel crash (denial of service) or, in advanced scenarios, memory corruption that could be leveraged for further exploitation (GitHub Advisory).

• Logs: Unexpected kernel oops, BUG, or panic messages in /var/log/kern.log or dmesg output referencing f_mass_storage, check_command_size_in_blocks, or USB gadget subsystem.
• Logs: Kernel warnings about out-of-bounds memory access or memory corruption in the USB gadget stack.
• Process/System: Sudden system instability, kernel crashes, or reboots on systems with USB mass storage gadget functionality enabled after connecting an unknown USB host device.
• Network/Physical: Unexpected or unauthorized USB host devices connected to USB device ports on embedded or IoT Linux systems.

Apply the official Linux kernel patches, which fix the issue by using the check_shl_overflow() macro in check_command_size_in_blocks() to safely detect integer overflows during the shift operation. Fixed versions are: 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9, and 7.0-rc4 (GitHub Advisory, SUSE Advisory). For systems where immediate patching is not feasible, disable the USB mass storage gadget functionality if it is not required, and restrict physical USB host access to trusted devices only.

Red Hat tracked the vulnerability via Bugzilla (BZ#2457276) and published a security advisory (Red Hat). SUSE issued a security update (SUSE-SU-2026:2217-1) addressing this and related kernel vulnerabilities (SUSE Advisory). The Yocto Project security mailing list also discussed the issue. Community reaction has been routine for a kernel USB driver fix, with no notable controversy or widespread media coverage observed.