High 7.8Published May 1, 2026

CVE-2026-31720usb: gadget: f_uac1_legacy: validate control request size

Updated under an hour ago (Oct 27, 2026, 8:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: validate control request size f_audio_complete() copies req->length bytes into a 4-byte stack variable: u32 data = 0; memcpy(&data, req->buf, req->length); req->length is derived from the host-controlled USB request path, which can lead to a stack out-of-bounds write. Validate req->actual against the expected payload size for the supported control selectors and decode only the expected amount of data. This avoids copying a host-influenced length into a fixed-size stack object.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c6994e6f067cf0fc4c6cca3d164018b1150916f8 before 557d1d4e862eccd0b74cc377b66de3e1e8d49605; from c6994e6f067cf0fc4c6cca3d164018b1150916f8 before 21b11e8581285c6f10ef43d05df349d445f24273; from c6994e6f067cf0fc4c6cca3d164018b1150916f8 before 0d41772d98dcaf6c17e875b7d0ea0154ae1191ee; from c6994e6f067cf0fc4c6cca3d164018b1150916f8 before c6da4fed7537aec19880c24f6c3a95065adb1406; from c6994e6f067cf0fc4c6cca3d164018b1150916f8 before be2d32f0c3fe333d14c0a9ca90328dacbc3e06b8; from c6994e6f067cf0fc4c6cca3d164018b1150916f8 before 8e5eb1d6e6a3d7bbea9c92132d0cda5793176426; from c6994e6f067cf0fc4c6cca3d164018b1150916f8 before 26304d124e7f0383f8fe1168b5801a0ac7e16b1c; from c6994e6f067cf0fc4c6cca3d164018b1150916f8 before 6e0e34d85cd46ceb37d16054e97a373a32770f6c	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.31 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.168; from 6.2 before 6.6.134; from 6.7 before 6.12.81; from 6.13 before 6.18.22; from 6.19 before 6.19.12; 7.0; and 5 more ranges	NVD

References

References

https://git.kernel.org/stable/c/557d1d4e862eccd0b74cc377b66de3e1e8d49605	patch
https://git.kernel.org/stable/c/21b11e8581285c6f10ef43d05df349d445f24273	patch
https://git.kernel.org/stable/c/0d41772d98dcaf6c17e875b7d0ea0154ae1191ee	patch
https://git.kernel.org/stable/c/c6da4fed7537aec19880c24f6c3a95065adb1406	patch
https://git.kernel.org/stable/c/be2d32f0c3fe333d14c0a9ca90328dacbc3e06b8	patch
https://git.kernel.org/stable/c/8e5eb1d6e6a3d7bbea9c92132d0cda5793176426	patch
https://git.kernel.org/stable/c/26304d124e7f0383f8fe1168b5801a0ac7e16b1c	patch
https://git.kernel.org/stable/c/6e0e34d85cd46ceb37d16054e97a373a32770f6c	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.