CVE-2026-31720

What it actually does

CVE-2026-31720 is a Linux kernel memory corruption flaw in the legacy USB Audio Class gadget function, f_uac1_legacy. The vulnerable code copies a host-influenced USB control request length into a fixed 4-byte stack variable without first validating that the received payload size matches the expected size for the supported audio control selector. A malicious or malformed USB host request can therefore cause a stack out-of-bounds write in kernel context. Depending on kernel configuration, mitigations, and reachable gadget configuration, this can result in kernel crash, denial of service, memory corruption, or potentially privilege escalation/code execution in kernel context.

Why it matters to the business

Systems that expose Linux USB gadget functionality using the legacy UAC1 audio gadget may be vulnerable to crashes or deeper compromise when connected to an untrusted or compromised USB host. The practical exposure is narrower than remotely exploitable network bugs because exploitation requires access to the USB gadget path, but affected embedded devices, appliances, development boards, mobile/OT devices, kiosks, and USB-connected products may face operational disruption, device compromise, or difficult-to-diagnose kernel instability. The CVSS score is high, but EPSS is currently very low and there is no known KEV listing or public exploit maturity indicated, so remediation should be prioritized for products or fleets that enable USB gadget/audio functions or regularly connect to untrusted hosts.

How an attack unfolds

An attacker positions themselves as, or compromises, a USB host connected to a Linux device operating in USB gadget mode with the legacy UAC1 audio function enabled. During USB enumeration or subsequent class-specific control interactions, the attacker sends a crafted audio control request whose payload length does not match the expected size for the control selector. In vulnerable kernels, the f_audio_complete() completion handler uses the request length influenced by that USB request and copies that many bytes into a 4-byte stack variable. If the length is larger than the destination, the copy corrupts adjacent stack memory in kernel context. The most likely outcome is a kernel panic or device crash, but under favorable conditions an attacker may be able to influence control flow or corrupt kernel state for privilege escalation or code execution.

How to fix it

Update the Linux kernel to a version or vendor backport that includes the f_uac1_legacy control request size validation fix. Because no exact fixed versions were provided, use the security advisory from the relevant Linux distribution, device vendor, or kernel supplier and verify that the patch for 'usb: gadget: f_uac1_legacy: validate control request size' is included. Where immediate patching is not possible, disable the legacy UAC1 USB gadget function if it is not required, avoid loading or configuring f_uac1_legacy, restrict use of USB gadget mode to trusted hosts only, and reduce physical or logical access to USB interfaces. For embedded products, ship a patched kernel image and review USB gadget configurations under configfs or board-specific initialization scripts to ensure vulnerable functionality is not exposed unnecessarily.

How to confirm the fix worked

Confirm the running kernel includes the vendor fix or upstream backport for f_uac1_legacy request-size validation. Validate package or image provenance against the distribution/vendor security advisory rather than relying only on the kernel version string, because many vendors backport fixes. Check whether the system can load or is using the vulnerable gadget function by reviewing loaded modules, kernel configuration, and USB gadget configfs entries. Useful checks include looking for f_uac1_legacy in loaded modules, built-in kernel symbols, initramfs contents, device tree/board startup scripts, and /sys/kernel/config/usb_gadget configurations. After remediation, regression-test USB gadget audio behavior with valid UAC1 control requests and, in a controlled lab only, malformed oversized requests to confirm the device rejects unexpected lengths without a kernel warning, oops, panic, or KASAN report.

Typical attack path

1. Identify a Linux-based target that operates as a USB gadget device and exposes the legacy UAC1 audio gadget function.
2. Gain physical, local, or adjacent control of the USB host side, or compromise a host system that the gadget device connects to.
3. Initiate or wait for USB enumeration and interact with the gadget's class-specific audio control endpoint.
4. Send a malformed control request with a payload length larger than the expected 4-byte destination or otherwise inconsistent with the supported control selector.
5. Trigger f_audio_complete() to copy the host-influenced request length into a fixed-size stack object.
6. Cause kernel memory corruption, typically resulting in a crash, and potentially attempt further exploitation for kernel-level control.

How to detect it

Look for evidence of exploitation in kernel logs, crash dumps, pstore/ramoops records, serial console logs, and endpoint telemetry around times when the device was connected to or enumerated by a USB host. Focus on kernel oops, panic, KASAN, UBSAN, stack corruption, or general protection fault messages involving USB gadget, f_uac1_legacy, UAC1, audio gadget, or f_audio_complete. Review USB connection and enumeration events immediately preceding crashes, especially repeated connect/disconnect cycles or class-specific control requests from the same host. On systems with crash dump collection, inspect vmcore or panic traces for call stacks containing f_audio_complete or f_uac1_legacy. Also review whether the vulnerable function was enabled through configfs under /sys/kernel/config/usb_gadget or loaded as a module. There are no known public threat actors, KEV exploitation reports, or ransomware usage indicated for this CVE, so detection should be behavior- and artifact-driven rather than actor-specific.

• f_uac1_legacy
• f_audio_complete
• usb: gadget: f_uac1_legacy
• KASAN: stack-out-of-bounds
• BUG: stack guard page was hit
• kernel stack overflow
• stack corruption detected
• general protection fault
• Unable to handle kernel paging request
• Kernel panic - not syncing
• /sys/kernel/config/usb_gadget
• libcomposite
• g_audio

What your security team should do

• Inventory Linux-based products and systems that operate in USB gadget/device mode, especially embedded devices, appliances, kiosks, development boards, and devices exposing USB audio gadget functionality.
• Prioritize patching systems where f_uac1_legacy is enabled, compiled in, or loaded as a module, particularly if they connect to untrusted, user-controlled, or frequently changing USB hosts.
• Obtain patched kernels or vendor firmware that include the fix for 'usb: gadget: f_uac1_legacy: validate control request size' and deploy through normal kernel or firmware update channels.
• If patching is delayed, disable the legacy UAC1 gadget function, remove unused gadget configurations, blacklist the module where applicable, and restrict physical or host-side USB access.
• Enable or review kernel crash, panic, and oops logging for USB-connected devices to identify possible exploitation attempts or malformed host interactions.
• Treat unexpected kernel crashes during USB enumeration or USB audio gadget interactions as suspicious until ruled out, especially on devices connected to untrusted hosts.
• Because EPSS is low and there is no KEV listing, prioritize based on actual exposure rather than broad emergency response; internet-facing network services are not the primary risk for this issue.