CVE-2026-31616

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()

A broken/bored/mean USB host can overflow the skb_shared_info->frags[]

array on a Linux gadget exposing a Phonet function by sending an

unbounded sequence of full-page OUT transfers.

pn_rx_complete() finalizes the skb only when req->actual < req->length,

where req->length is set to PAGE_SIZE by the gadget. If the host always

sends exactly PAGE_SIZE bytes per transfer, fp->rx.skb will never be

reset and each completion will add another fragment via

skb_add_rx_frag(). Once nr_frags exceeds MAX_SKB_FRAGS (default 17),

subsequent frag stores overwrite memory adjacent to the shinfo on the

heap.

Drop the skb and account a length error when the frag limit is reached,

matching the fix applied in t7xx by commit f0813bcd2d9d ("net: wwan:

t7xx: fix potential skb->frags overflow in RX path").