Linux Kernel f_mass_storage Integer Overflow in check_command_size_in_blocks
CVE-2026-31412 Published on April 10, 2026
usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks()
The `check_command_size_in_blocks()` function calculates the data size
in bytes by left shifting `common->data_size_from_cmnd` by the block
size (`common->curlun->blkbits`). However, it does not validate whether
this shift operation will cause an integer overflow.
Initially, the block size is set up in `fsg_lun_open()` , and the
`common->data_size_from_cmnd` is set up in `do_scsi_command()`. During
initialization, there is no integer overflow check for the interaction
between two variables.
So if a malicious USB host sends a SCSI READ or WRITE command
requesting a large amount of data (`common->data_size_from_cmnd`), the
left shift operation can wrap around. This results in a truncated data
size, which can bypass boundary checks and potentially lead to memory
corruption or out-of-bounds accesses.
Fix this by using the check_shl_overflow() macro to safely perform the
shift and catch any overflows.
Products Associated with CVE-2026-31412
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 144974e7f9e32b53b02f6c8632be45d8f43d6ab5 and below 91817ad5452defe69bc7bc0e355f0ed5d01125cc is affected.
- Version 144974e7f9e32b53b02f6c8632be45d8f43d6ab5 and below ce0caaed5940162780c5c223b8ae54968a5f059b is affected.
- Version 144974e7f9e32b53b02f6c8632be45d8f43d6ab5 and below 228b37936376143f4b60cc6828663f6eaceb81b5 is affected.
- Version 144974e7f9e32b53b02f6c8632be45d8f43d6ab5 and below 3428dc5520c811e66622b2f5fa43341bf9a1f8b3 is affected.
- Version 144974e7f9e32b53b02f6c8632be45d8f43d6ab5 and below 387ebb0453b99d71491419a5dc4ab4bee0cacbac is affected.
- Version 144974e7f9e32b53b02f6c8632be45d8f43d6ab5 and below 8479891d1f04a8ce55366fe4ca361ccdb96f02e1 is affected.
- Version 3.3 is affected.
- Before 3.3 is unaffected.
- Version 6.1.167, <= 6.1.* is unaffected.
- Version 6.6.130, <= 6.6.* is unaffected.
- Version 6.12.78, <= 6.12.* is unaffected.
- Version 6.18.19, <= 6.18.* is unaffected.
- Version 6.19.9, <= 6.19.* is unaffected.
- Version 7.0-rc4, <= * is unaffected.