CVE-2026-31412

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() The `check_command_size_in_blocks()` function calculates the data size in bytes by left shifting `common->data_size_from_cmnd` by the block size (`common->curlun->blkbits`). However, it does not validate whether this shift operation will cause an integer overflow. Initially, the block size is set up in `fsg_lun_open()` , and the `common->data_size_from_cmnd` is set up in `do_scsi_command()`. During initialization, there is no integer overflow check for the interaction between two variables. So if a malicious USB host sends a SCSI READ or WRITE command requesting a large amount of data (`common->data_size_from_cmnd`), the left shift operation can wrap around. This results in a truncated data size, which can bypass boundary checks and potentially lead to memory corruption or out-of-bounds accesses. Fix this by using the check_shl_overflow() macro to safely perform the shift and catch any overflows.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://git.kernel.org/stable/c/91817ad5452defe69bc7bc0e355f0ed5d01125cc ↗
• https://git.kernel.org/stable/c/ce0caaed5940162780c5c223b8ae54968a5f059b ↗
• https://git.kernel.org/stable/c/228b37936376143f4b60cc6828663f6eaceb81b5 ↗
• https://git.kernel.org/stable/c/3428dc5520c811e66622b2f5fa43341bf9a1f8b3 ↗
• https://git.kernel.org/stable/c/387ebb0453b99d71491419a5dc4ab4bee0cacbac ↗
• https://git.kernel.org/stable/c/8479891d1f04a8ce55366fe4ca361ccdb96f02e1 ↗