Vulnerabilities ›

CVE-2026-31720

High

CWE-787 — Weakness Type

                    Published: May 1, 2026                      ·  Modified: May 8, 2026                      ·  Source: NVD                

CVSS v3

7.8

🔗 NVD Official

📄 Description (English)

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_uac1_legacy: validate control request size

f_audio_complete() copies req->length bytes into a 4-byte stack
variable:

u32 data = 0;
memcpy(&data, req->buf, req->length);

req->length is derived from the host-controlled USB request path,
which can lead to a stack out-of-bounds write.

Validate req->actual against the expected payload size for the
supported control selectors and decode only the expected amount
of data.

This avoids copying a host-influenced length into a fixed-size
stack object.

🤖 AI Executive Summary

CVE-2026-31720 is a stack buffer overflow vulnerability in the Linux kernel's USB audio gadget driver (f_uac1_legacy) that allows remote attackers to write beyond a 4-byte stack variable through malformed USB control requests. With a CVSS score of 7.8, this vulnerability enables denial of service and potential code execution on systems exposing USB audio gadget functionality. The vulnerability affects Linux kernel versions up to 7.0-rc3 and requires immediate patching for systems utilizing USB audio device emulation.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: May 7, 2026 03:48

🇸🇦 Saudi Arabia Impact Assessment

This vulnerability primarily impacts Saudi organizations operating IoT devices, embedded systems, and industrial control systems that utilize Linux-based USB audio gadget functionality. Critical sectors at risk include: (1) Healthcare institutions using medical devices with USB audio interfaces; (2) Telecommunications providers (STC, Mobily) managing network equipment with USB audio capabilities; (3) Government agencies deploying embedded Linux systems; (4) Manufacturing and industrial facilities using USB-connected audio devices for monitoring. The vulnerability is particularly concerning for ARAMCO and other energy sector organizations using Linux-based SCADA systems with USB interfaces. Organizations running Linux kernel versions prior to 7.0 on USB-exposed systems face elevated risk of system compromise and service disruption.

🏢 Affected Saudi Sectors

Healthcare Telecommunications Government Energy/Oil & Gas Manufacturing/Industrial Education Financial Services

🎯 MITRE ATT&CK Techniques

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution T1499 - Endpoint Denial of Service T1068 - Exploitation for Privilege Escalation

⚖️ Saudi Risk Score (AI)

7.8

/ 10.0

🔧 Remediation Steps (English)

Immediate Actions:

1. Identify all systems running affected Linux kernel versions (pre-7.0-rc4) with USB audio gadget functionality enabled

2. Disable USB audio gadget driver (f_uac1_legacy) if not required: echo 'blacklist usb_f_uac1_legacy' >> /etc/modprobe.d/blacklist.conf

3. Restrict USB device access through physical controls and BIOS settings where possible



Patching Guidance:

1. Update Linux kernel to version 7.0-rc4 or later

2. For enterprise distributions, apply vendor-specific patches: RHEL/CentOS, Ubuntu, Debian kernel updates

3. Verify patch application: grep -i 'validate control request size' /usr/src/linux/drivers/usb/gadget/f_uac1_legacy.c



Compensating Controls (if immediate patching unavailable):

1. Implement strict USB device policy via udev rules to prevent unauthorized USB audio device attachment

2. Monitor USB device enumeration logs for suspicious control requests

3. Isolate affected systems from untrusted USB sources

4. Implement network segmentation for systems requiring USB audio functionality



Detection Rules:

1. Monitor kernel logs for USB gadget errors: grep 'f_uac1_legacy\|usb.*error' /var/log/kern.log

2. Alert on unusual USB control request sizes exceeding 4 bytes for audio control selectors

3. Monitor for stack corruption indicators and kernel panics related to USB subsystem

4. Implement IDS signatures detecting malformed USB audio control requests with oversized payloads

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. تحديد جميع الأنظمة التي تعمل بإصدارات نواة Linux المتأثرة (قبل 7.0-rc4) مع تفعيل وظائف جهاز الصوت USB

2. تعطيل برنامج تشغيل جهاز الصوت USB (f_uac1_legacy) إذا لم يكن مطلوبًا: echo 'blacklist usb_f_uac1_legacy' >> /etc/modprobe.d/blacklist.conf

3. تقييد الوصول إلى جهاز USB من خلال الضوابط المادية وإعدادات BIOS حيث أمكن

إرشادات التصحيح:

1. تحديث نواة Linux إلى الإصدار 7.0-rc4 أو أحدث

2. بالنسبة للتوزيعات الموجهة للمؤسسات، تطبيق التصحيحات الخاصة بالبائع: تحديثات نواة RHEL/CentOS و Ubuntu و Debian

3. التحقق من تطبيق التصحيح: grep -i 'validate control request size' /usr/src/linux/drivers/usb/gadget/f_uac1_legacy.c

الضوابط البديلة (إذا لم يكن التصحيح الفوري متاحًا):

1. تنفيذ سياسة جهاز USB صارمة عبر قواعد udev لمنع إرفاق جهاز صوت USB غير مصرح به

2. مراقبة سجلات تعداد جهاز USB للطلبات المريبة

3. عزل الأنظمة المتأثرة عن مصادر USB غير الموثوقة

4. تنفيذ تقسيم الشبكة للأنظمة التي تتطلب وظائف صوت USB

قواعد الكشف:

1. مراقبة سجلات النواة لأخطاء جهاز USB: grep 'f_uac1_legacy\|usb.*error' /var/log/kern.log

2. التنبيه على أحجام طلبات التحكم USB غير العادية التي تتجاوز 4 بايتات لمحددات التحكم الصوتي

3. مراقبة مؤشرات تلف المكدس والأعطال الحرجة للنواة المتعلقة بنظام فرعي USB

4. تنفيذ توقيعات IDS للكشف عن طلبات التحكم الصوتي USB المشوهة ذات الحمولات الكبيرة

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2024 A.14.2.1 - System change control and management ECC 2024 A.12.6.1 - Management of technical vulnerabilities ECC 2024 A.12.2.1 - Monitoring of system use

🔵 SAMA CSF

SAMA CSF ID.RA-1 - Asset management and vulnerability identification SAMA CSF PR.IP-12 - System development and maintenance SAMA CSF DE.CM-1 - Detection and monitoring of anomalies

🟡 ISO 27001:2022

ISO 27001:2022 A.12.6.1 - Management of technical vulnerabilities ISO 27001:2022 A.14.2.1 - Change control procedures ISO 27001:2022 A.8.1.3 - Segregation of duties ISO 27001:2022 A.12.2.1 - Monitoring of system use

🟣 PCI DSS v4.0.1

PCI DSS 6.2 - Security patches and updates for system components PCI DSS 11.2 - Vulnerability scanning and assessment

🔗 References & Sources 8

🔗

https://git.kernel.org/stable/c/0d41772d98dcaf6c17e875b7d0ea0154ae1191ee

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

🔗

https://git.kernel.org/stable/c/21b11e8581285c6f10ef43d05df349d445f24273

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

🔗

https://git.kernel.org/stable/c/26304d124e7f0383f8fe1168b5801a0ac7e16b1c

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

🔗

https://git.kernel.org/stable/c/557d1d4e862eccd0b74cc377b66de3e1e8d49605

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

🔗

https://git.kernel.org/stable/c/6e0e34d85cd46ceb37d16054e97a373a32770f6c

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

🔗

https://git.kernel.org/stable/c/8e5eb1d6e6a3d7bbea9c92132d0cda5793176426

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

🔗

https://git.kernel.org/stable/c/be2d32f0c3fe333d14c0a9ca90328dacbc3e06b8

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

🔗

https://git.kernel.org/stable/c/c6da4fed7537aec19880c24f6c3a95065adb1406

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Patch

📦 Affected Products / CPE 13 entries

linux:linux_kernel

linux:linux_kernel:7.0

📊 CVSS Score

7.8

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorL — Low / Local

Attack ComplexityL — Low / Local

Privileges RequiredL — Low / Local

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityH — High

IntegrityH — High

AvailabilityH — High

📋 Quick Facts

Severity High

CVSS Score7.8

CWECWE-787

EPSS0.02%

Exploit No

Patch ✓ Yes

Published 2026-05-01

Source Feed nvd

🇸🇦 Saudi Risk Score

7.8

/ 10.0 — Saudi Risk

Priority: HIGH

🏷️ Tags

patch-available CWE-787

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 Comments

Loading comments

CVE-2026-31720

💬 Comments

Introduce Yourself

Sign In Required