The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT     response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU.
    This value is subsequently used as the loop bound in usbip_recv_iso() and usbip_pad_iso() to iterate over     urb->iso_frame_desc[], a flexible array whose size was fixed at URB allocation time based on the
    *original* number_of_packets from the CMD_SUBMIT. A malicious USB/IP server can set number_of_packets in     the response to a value larger than what was originally submitted, causing a heap out-of-bounds write when     usbip_recv_iso() writes to urb->iso_frame_desc[i] beyond the allocated region. KASAN confirmed this with     kernel 7.0.0-rc5: BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640 Write of size 4 at addr     ffff888106351d40 by task vhci_rx/69 The buggy address is located 0 bytes to the right of allocated     320-byte region [ffff888106351c00, ffff888106351d40) The server side (stub_rx.c) and gadget side     (vudc_rx.c) already validate number_of_packets in the CMD_SUBMIT path since commits c6688ef9f297 (usbip:
    fix stub_rx: harden CMD_SUBMIT path to handle malicious input) and b78d830f0049 (usbip: fix vudc_rx:
    harden CMD_SUBMIT path to handle malicious input). The server side validates against     USBIP_MAX_ISO_PACKETS because no URB exists yet at that point. On the client side we have the original     URB, so we can use the tighter bound: the response must not exceed the original number_of_packets. This     mirrors the existing validation of actual_length against transfer_buffer_length in usbip_recv_xbuff(),     which checks the response value against the original allocation size. Kelvin Mbogo's series (usb: usbip:
    fix integer overflow in usbip_recv_iso(), v2) hardens the receive-side functions themselves; this patch     complements that work by catching the bad value at its source -- in usbip_pack_ret_submit() before the     overwrite -- and using the tighter per-URB allocation bound rather than the global USBIP_MAX_ISO_PACKETS     limit. Fix this by checking rpdu->number_of_packets against urb->number_of_packets in     usbip_pack_ret_submit() before the overwrite. On violation, clamp to zero so that usbip_recv_iso() and     usbip_pad_iso() safely return early. (CVE-2026-31607)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-31607

critical Nessus Plugin ID 310328

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.8 May 2, 2026, 11:12 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605022312
Version 1.7 Apr 30, 2026, 4:16 PM CVSSv3 score source (changed from "CVE-2026-31607" to none) Plugin Feed: 202604301616
Version 1.6 Apr 30, 2026, 3:55 AM CVSS metrics ("CVSSv2 score" set to 6.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSSv2 severity (based on CVE-2026-31607, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202604300355
Version 1.5 Apr 29, 2026, 12:50 PM CVSS metrics ("CVSSv2 score" set to none) CVSS metrics ("CVSSv2 vector" set to none) CVSS temporal metrics ("CVSSv2 temporal vector" set to none) CVSSv2 severity (based on CVE-2026-31607, severity increased from "Medium" to "High") CVSSv3 score source (set to "CVE-2026-31607") Detection (updated detection logic) Plugin metadata Plugin Feed: 202604291250
Version 1.4 Apr 28, 2026, 8:33 AM CVSS metrics ("CVSSv3 score" set to 9.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") Plugin Feed: 202604280833
Version 1.3 Apr 26, 2026, 5:43 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202604260543
Version 1.2 Apr 26, 2026, 1:19 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202604260119
Version 1.1 Apr 25, 2026, 4:14 PM New Plugin Feed: 202604251614