CVE-2026-31616: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31616 is a heap buffer overflow vulnerability in the Linux kernel's USB gadget Phonet function (f_phonet), specifically in the pn_rx_complete() function. A malicious or misbehaving USB host can trigger an unbounded sequence of full-page OUT transfers that overflow the skb_shared_info->frags[] array, leading to an out-of-bounds write on the heap. The vulnerability affects Linux kernel versions from 2.6.32 through multiple stable branches, with fixes available in versions 6.6.136, 6.12.83, 6.18.24, 6.19.14, and 7.0.1. It was published on April 24, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-787 (Out-of-bounds Write) and CWE-401 (Missing Release of Memory after Effective Lifetime). The pn_rx_complete() function only finalizes and resets the socket buffer (fp->rx.skb) when req->actual < req->length, where req->length is set to PAGE_SIZE. If a USB host continuously sends exactly PAGE_SIZE bytes per transfer, the receive buffer is never reset, and each completion appends another fragment via skb_add_rx_frag(). Once nr_frags exceeds MAX_SKB_FRAGS (default 17), subsequent fragment stores overwrite heap memory adjacent to the shinfo structure, resulting in a heap out-of-bounds write. The fix drops the skb and accounts a length error when the fragment limit is reached, mirroring the approach used in commit f0813bcd2d9d for the t7xx WWAN driver (GitHub Advisory).

Successful exploitation can cause kernel memory corruption, leading to denial of service via kernel crash. In more severe scenarios, heap memory manipulation beyond the skb_shared_info structure could potentially enable arbitrary code execution on the gadget device, though this is considered a less likely outcome. Confidentiality and integrity impacts are rated as none in the CVSS scoring, with the primary risk being availability loss. The attack is limited to systems running Linux with the USB gadget Phonet function exposed and requires physical or logical USB access (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.014% (3rd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local or physical USB access to a system running the Linux kernel with the Phonet USB gadget function enabled, which significantly limits the attack surface (GitHub Advisory, Feedly).

1. Identify target: Locate a Linux system operating as a USB gadget with the Phonet function (f_phonet) enabled and exposing it over USB.
2. Connect malicious USB host: Attach a controlled USB host device (e.g., a custom USB controller or a Linux system acting as USB host) to the target gadget device.
3. Send continuous PAGE_SIZE OUT transfers: Craft and send an unbounded sequence of USB OUT transfers, each exactly PAGE_SIZE bytes (typically 4096 bytes), to the Phonet gadget endpoint.
4. Exhaust fragment array: Each transfer completion calls skb_add_rx_frag(), incrementing nr_frags. Since req->actual == req->length, the skb is never finalized or reset.
5. Trigger out-of-bounds write: After 17 transfers (exceeding MAX_SKB_FRAGS), subsequent fragment stores overwrite heap memory adjacent to the skb_shared_info structure, causing memory corruption.
6. Achieve denial of service or code execution: The heap corruption can crash the kernel (DoS) or, with further heap manipulation, potentially redirect execution flow (GitHub Advisory, Feedly).

• Logs: Kernel logs (dmesg) showing memory corruption warnings, BUG/OOPS messages, or kernel panics originating from USB gadget or networking subsystems; messages referencing pn_rx_complete, skb_add_rx_frag, or f_phonet.
• Process/Kernel Behavior: Unexpected kernel crashes or reboots on systems with USB gadget Phonet functionality enabled; kernel WARN or BUG traces involving skb_shared_info or fragment count overflows.
• Network: Unusual or repeated USB OUT transfer completions of exactly PAGE_SIZE bytes on Phonet gadget endpoints visible in USB traffic captures.
• File System: Kernel crash dump files (e.g., /var/crash/, kdump artifacts) generated around the time of USB gadget activity.

Update the Linux kernel to a patched version: 6.6.136, 6.12.83, 6.18.24, 6.19.14, or 7.0.1 or later, which include fixes via multiple stable tree commits. If immediate patching is not feasible, disable the Phonet USB gadget function if it is not operationally required, or restrict USB connections to trusted and physically controlled hosts only. Monitoring gadget systems for unexpected kernel crashes or memory corruption errors is also recommended as a detection measure (GitHub Advisory, Feedly).