CVE-2026-31623: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31623 is a buffer overflow vulnerability in the Linux kernel's CDC Phonet USB driver (net/usb/cdc-phonet) that allows a malicious USB device to overflow the skb_shared_info->frags[] array by sending an unbounded sequence of full-page bulk transfers in the rx_complete() function. It affects Linux kernel versions 2.6.31 through 6.6.135, 6.7 through 6.12.82, 6.13 through 6.18.23, 6.19 through 6.19.13, and 7.0 prior to 7.0.1. The vulnerability was published on April 24, 2026, and has a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-120 (Buffer Copy without Checking Size of Input / Classic Buffer Overflow). The rx_complete() function in the cdc-phonet USB driver does not enforce a limit on the number of scatter-gather fragments (frags[]) accumulated in an skb_shared_info structure during USB bulk receive operations. A malicious USB device posing as a CDC Phonet modem can send an unbounded sequence of full-page bulk transfers, causing the frags[] array — which has a fixed maximum size — to overflow, corrupting adjacent kernel memory. The fix mirrors the approach taken in commit f0813bcd2d9d for the t7xx WWAN driver: drop the skb and increment a length error counter when the fragment limit is reached (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can result in kernel memory corruption, leading to a denial of service (system crash/kernel panic) or potentially arbitrary code execution at kernel privilege level. Because the attack originates from a physically connected USB device, the blast radius is limited to the local system; however, kernel-level code execution could enable full system compromise, privilege escalation, and lateral movement within a network. Confidentiality and integrity are not directly impacted under the CVSS assessment, but the availability impact is rated High (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The attack requires physical access to connect a malicious USB device to the target system, and a low-privilege local user account is needed per the CVSS assessment. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat Bugzilla).

1. Prepare a malicious USB device: Program a USB device (e.g., using a microcontroller or USB gadget framework on a Linux system) to enumerate as a CDC Phonet modem by advertising the appropriate USB device class, subclass, and protocol identifiers.
2. Connect to target: Physically connect the malicious USB device to a target system running a vulnerable Linux kernel version (2.6.31–6.6.135, 6.7–6.12.82, 6.13–6.18.23, 6.19–6.19.13, or 7.0 < 7.0.1) with the cdc-phonet driver loaded.
3. Trigger driver binding: The kernel automatically loads and binds the cdc-phonet driver to the device upon connection.
4. Send unbounded bulk transfers: Transmit a continuous stream of full-page USB bulk transfer packets from the malicious device, causing rx_complete() to append fragments to skb_shared_info->frags[] without bound.
5. Overflow the frags[] array: Once the number of fragments exceeds MAX_SKB_FRAGS, the array overflows into adjacent kernel memory, causing corruption that can result in a kernel panic (DoS) or, under controlled conditions, arbitrary kernel code execution (GitHub Advisory).

• Physical/Hardware: Unexpected or unrecognized USB device connected to the system, particularly one advertising CDC Phonet modem class.
• Logs: Kernel logs (dmesg / /var/log/kern.log) showing repeated cdc_phonet driver bind events, USB enumeration of unknown devices, or kernel BUG/oops/panic traces referencing rx_complete() or skb_shared_info.
• Process/System: Unexpected kernel panics or system reboots; kernel crash dumps (/var/crash) with stack traces involving net/usb/cdc-phonet.c.
• Network: Unusual USB bulk transfer activity visible via USB monitoring tools (e.g., usbmon) showing high-volume, full-page bulk IN transfers from a CDC Phonet interface.

Update the Linux kernel to a patched version: 6.6.136 or later, 6.12.83 or later, 6.18.24 or later, 6.19.14 or later, or 7.0.1 or later. Multiple stable kernel commits address this issue: 600dc40554dc, 9989938d13cc, a23b1b1aaf41, c183d5775129, d4e1946bea8d, and ebf75c6301c4. For systems that cannot be immediately patched, mitigate risk by restricting physical USB port access, implementing strict physical security controls, and blacklisting or disabling the cdc-phonet kernel module (echo 'blacklist cdc_phonet' >> /etc/modprobe.d/blacklist.conf) if CDC Phonet functionality is not required (GitHub Advisory, Red Hat Bugzilla).