SECUFOCUSNOW
Home›CVE index›CVE-2026-31607
Review reviewCritical

CVE-2026-31607

Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support

In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU. This value is subsequently used as the loop bound in usbip_recv_iso() and usbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible array whose size was fixed at URB allocation time based on the *original* number_of_packets from the CMD_SUBMIT. A malicious USB/IP server can set number_of_packets in the respons...

CVSS
9.8
EPSS
0.31%
23.5% percentile
CISA KEV
Not listed
Published
2026.04.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.31%
Technical severityCVSS 9.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU. This value is subsequently used as the loop bound in usbip_recv_iso() and usbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible array whose size was fixed at URB allocation time based on the *original* number_of_packets from the CMD_SUBMIT. A malicious USB/IP server can set number_of_packets in the respons...

Affected product and versions

Product
Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support
Affected versions
>= 1325f85fa49f57df034869de430f7c302ae23109 < 324262c38438255bf6bdbf6342ca47c0badaab76, >= 1325f85fa49f57df034869de430f7c302ae23109 < 973f2c250289f5bf6cc146b98aa6fdde11fe50d6, >= 1325f85fa49f57df034869de430f7c302ae23109 < ce744264b06b97069b3722511ab355738311fee0, >= 1325f85fa49f57df034869de430f7c302ae23109 < 885c8591784da6314f9aa82fa460ac69f9f79e5f, >= 1325f85fa49f57df034869de430f7c302ae23109 < 8d155e2d1c4102f74f82a2bf9c016164bb0f7384, >= 1325f85fa49f57df034869de430f7c302ae23109 < 906f16a836de13fe61f49cdce2f66f2dbd14caf4, >= 1325f85fa49f57df034869de430f7c302ae23109 < ef8ebb1c637b4cfb61a9dd2e013376774ee2033b, >= 1325f85fa49f57df034869de430f7c302ae23109 < 5e1c4ece08ccdc197177631f111845a2c68eede3, >= 1325f85fa49f57df034869de430f7c302ae23109 < 2ab833a16a825373aad2ba7d54b572b277e95b71, >= d9638d9236eed035a575feddec61d036dacc2676, >= ca7d3501b7a287c18b5b470e871d3029b0f4842a, >= 1ce528277e1a66856ed3f7526c1e3458c0ed4a70, >= db898d0c5c493ce4177d5e1d3a953e079a56a24b, >= 5aa02704b9ee67c5b2ee26d54c5f4eb99e93ba9a, >= 2.6.32.37 < 2.6.33, >= 2.6.33.10 < 2.6.34, >= 2.6.34.11 < 2.6.35, >= 2.6.35.13 < 2.6.36, >= 2.6.38.3 < 2.6.39, >= 2.6.39
Fixed versions
6.6.136, 6.12.83, 6.18.24, 6.19.14, 7.0.1

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-787, CWE-805