CVE-2026-31720
highpriority · track · 41EPSS 0.001 · 3 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-26
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: validate control request size f_audio_complete() copies req->length bytes into a 4-byte stack variable: u32 data = 0; memcpy(&data, req->buf, req->length); req->length is derived from the host-controlled USB request path, which can lead to a stack out-of-bounds write. Validate req->actual against the expected payload size for the supported control selectors and decode only the expected amount of data. This avoids copying a host-influenced length into a fixed-size stack object.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
affected products (60)
Products and version ranges known to be affected.
- Red Hat OpenShift Container Platformall versionscert_bundDEcpe:/a:redhat:openshift:container_platform
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-1346Linux Kernel: Mehrere SchwachstellenDeutsch2026-05-03csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Root-Rechte zu erlangen, um Sicherheitsmechanismen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder Auswirkungen unbestimmter Art zu erzielen.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (18)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2026-31720cnnvd
- https://www.kernel.org/category/releases.htmlPatchcnnvd
- https://git.kernel.org/stable/c/0d41772d98dcaf6c17e875b7d0ea0154ae1191eeenisa_euvd
- https://git.kernel.org/stable/c/21b11e8581285c6f10ef43d05df349d445f24273enisa_euvd
- https://git.kernel.org/stable/c/26304d124e7f0383f8fe1168b5801a0ac7e16b1cenisa_euvd
- https://git.kernel.org/stable/c/557d1d4e862eccd0b74cc377b66de3e1e8d49605enisa_euvd
- https://git.kernel.org/stable/c/6e0e34d85cd46ceb37d16054e97a373a32770f6cenisa_euvd
- https://git.kernel.org/stable/c/8e5eb1d6e6a3d7bbea9c92132d0cda5793176426enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan