Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-31616

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() A broken/bored/mean USB host can overflow the skb_shared_info->frags[] array on a Linux gadget exposing a Phonet function by sending an unbounded sequence of full-page OUT transfers. pn_rx_complete() finalizes the skb only when req->actual < req->length, where req->length is set to PAGE_SIZE by the gadget. If the host always sends exactly PAGE_SIZE bytes per
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:4b9fbe5deb0720036f9ec6bf7b9897caebff0a4ec999eb9e26830334ab6efff1
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_phonet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.32"},{"lessThan":"2.6.32","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:9d6f6c59a51a444bf140e25d0df356c34c35cc5075e38d9796286c9ce4244085 · sha256:f7b17f75918da336… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_phonet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3d7f7e0c842242878c24b2facff8d6eda23ee1e9","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"b5ec49fa198bd08967a3102bd41f53ccadce72c9","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"7424f0287da73d3d8c5fa5e9d25d26fce762708e","status":"affected","version":"b91cd14…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:9d6f6c59a51a444bf140e25d0df356c34c35cc5075e38d9796286c9ce4244085 · sha256:f7b17f75918da336… · /containers/cna/affected/0

Affected products and versions

2 source assertions
{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_phonet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.32"},{"lessThan":"2.6.32","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:9d6f6c59a51a444bf140e25d0df356c34c35cc5075e38d9796286c9ce4244085 · sha256:f7b17f75918da336… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_phonet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3d7f7e0c842242878c24b2facff8d6eda23ee1e9","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"b5ec49fa198bd08967a3102bd41f53ccadce72c9","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"7424f0287da73d3d8c5fa5e9d25d26fce762708e","status":"affected","version":"b91cd14…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:9d6f6c59a51a444bf140e25d0df356c34c35cc5075e38d9796286c9ce4244085 · sha256:f7b17f75918da336… · /containers/cna/affected/0

Source references

9 source assertions
{"url":"https://git.kernel.org/stable/c/3d7f7e0c842242878c24b2facff8d6eda23ee1e9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:9d6f6c59a51a444bf140e25d0df356c34c35cc5075e38d9796286c9ce4244085 · sha256:f7b17f75918da336… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/4e476c25bfcab0535ba7c76a903ae77ca8747711"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:9d6f6c59a51a444bf140e25d0df356c34c35cc5075e38d9796286c9ce4244085 · sha256:f7b17f75918da336… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/66f7471c4042e4eb300e30b5b9d87d1406862673"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:9d6f6c59a51a444bf140e25d0df356c34c35cc5075e38d9796286c9ce4244085 · sha256:f7b17f75918da336… · /containers/cna/references/7
{"url":"https://git.kernel.org/stable/c/7424f0287da73d3d8c5fa5e9d25d26fce762708e"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:9d6f6c59a51a444bf140e25d0df356c34c35cc5075e38d9796286c9ce4244085 · sha256:f7b17f75918da336… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/9ceff1251904901b0b4e5fe6350fcaffa368ce83"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:9d6f6c59a51a444bf140e25d0df356c34c35cc5075e38d9796286c9ce4244085 · sha256:f7b17f75918da336… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/b5ec49fa198bd08967a3102bd41f53ccadce72c9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:9d6f6c59a51a444bf140e25d0df356c34c35cc5075e38d9796286c9ce4244085 · sha256:f7b17f75918da336… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/bd44ce09b9b569f49ed13e2d87d23d853fc7d6a7"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:9d6f6c59a51a444bf140e25d0df356c34c35cc5075e38d9796286c9ce4244085 · sha256:f7b17f75918da336… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/c088d5dd2fffb4de1fb8e7f57751c8b82942180a"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:9d6f6c59a51a444bf140e25d0df356c34c35cc5075e38d9796286c9ce4244085 · sha256:f7b17f75918da336… · /containers/cna/references/8
{"url":"https://git.kernel.org/stable/c/c9315ce9da3632c591666a29de82d3e92d46bec1"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:9d6f6c59a51a444bf140e25d0df356c34c35cc5075e38d9796286c9ce4244085 · sha256:f7b17f75918da336… · /containers/cna/references/4

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer