In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_uac1_legacy: validate control request size
f_audio_complete() copies req->length bytes into a 4-byte stack
variable:
u32 data = 0;
memcpy(&data, req->buf, req->length);
req->length is derived from the host-controlled USB request path,
which can lead to a stack out-of-bounds write.
Validate req->actual against the expected payload size for the
supported control selectors and decode only the expected amount
of data.
This avoids copying a host-influenced length into a fixed-size
stack object.
References
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2026-05-01 15:16
Updated : 2026-06-17 10:34
NVD link : CVE-2026-31720
Mitre link : CVE-2026-31720
CVE.ORG link : CVE-2026-31720
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-787
Out-of-bounds Write