Medium 5.5Published Apr 24, 2026

CVE-2026-31623net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()

Updated under an hour ago (Oct 28, 2026, 1:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() A malicious USB device claiming to be a CDC Phonet modem can overflow the skb_shared_info->frags[] array by sending an unbounded sequence of full-page bulk transfers. Drop the skb and increment the length error when the frag limit is reached. This matches the same fix that commit f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path") did for the t7xx driver.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Jun 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 before 6807ff49bf796b3823b1e29f97b69316a40a9a94; 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 builds before 0c5c65a17db729fc63ab656bdaaf0e675a9dbeac; from 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 before 6053620fdbcd89fa7e755644efdaab78e0daaae7; from 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 before d4e1946bea8d6441835eb3fd09b19237ba366a6f; from 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 before a23b1b1aaf41e174181d5853a70e65d4d01e648c; from 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 before c183d5775129a0a7495bd61a6e57ec230dcf01e5; from 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 before ebf75c6301c4972a87542ebf2d994c6391eb5d46; from 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 before 9989938d13cc5ba8447eeed5a61acfcf61bc6801; and 1 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.31 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; from 7.0 before 7.0.1	NVD

References

References

https://git.kernel.org/stable/c/6807ff49bf796b3823b1e29f97b69316a40a9a94
https://git.kernel.org/stable/c/0c5c65a17db729fc63ab656bdaaf0e675a9dbeac
https://git.kernel.org/stable/c/6053620fdbcd89fa7e755644efdaab78e0daaae7
https://git.kernel.org/stable/c/d4e1946bea8d6441835eb3fd09b19237ba366a6f	patch
https://git.kernel.org/stable/c/a23b1b1aaf41e174181d5853a70e65d4d01e648c	patch
https://git.kernel.org/stable/c/c183d5775129a0a7495bd61a6e57ec230dcf01e5	patch
https://git.kernel.org/stable/c/ebf75c6301c4972a87542ebf2d994c6391eb5d46	patch
https://git.kernel.org/stable/c/9989938d13cc5ba8447eeed5a61acfcf61bc6801	patch
https://git.kernel.org/stable/c/600dc40554dc5ad1e6f3af51f700228033f43ea7	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.