CVE-2026-31720

kernel: usb: gadget: f_uac1_legacy: validate control request size

Loading…

Severity

Unknown

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · May 1, 2026

Updated · June 28, 2026

Description

A flaw was found in the Linux kernel's USB gadget audio class 1 (UAC1) legacy function. A remote attacker could exploit this vulnerability by sending a malicious USB control request, causing an out-of-bounds write on the stack. This could lead to a denial of service or potentially arbitrary code execution.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-787 · Out-of-bounds Write