Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-31615 Details

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: renesas_usb3: validate endpoint index in standard request handlers The GET_STATUS and SET/CLEAR_FEATURE handlers extract the endpoint number from the host-supplied wIndex without any sort of validation. Fix this up by validating the number of endpoints actually match up with the number the device has before attempting to dereference a pointer based on this math. This is just like what was done in commit ee0d382feb44 ("usb: gadget: aspeed_udc: validate endpoint index for ast udc") for the aspeed driver.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:5.5 MEDIUMVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://git.kernel.org/stable/c/1b2bfedccc4fb8c9572e1ea464f905424c91de2a kernel.orgPatch
https://git.kernel.org/stable/c/360aa6e71870a175a6d86af905be2ca171639eb3 kernel.org
https://git.kernel.org/stable/c/37f430b2240655e6b0199a92aa1057e4d621be51 kernel.orgPatch
https://git.kernel.org/stable/c/44216e3dd4455b798899b50eedb0ec3831dff8e0 kernel.orgPatch
https://git.kernel.org/stable/c/7caaf76207f50c77abfd788380e19b2c23a94415 kernel.org

see all 9 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-476NULL Pointer Dereference[email protected]

Affected Products

ProductVersions
linux linux kernel
>= 4.5, < 6.6.136
>= 6.12, < 6.12.83
>= 6.13, < 6.18.24
>= 6.19, < 6.19.14
>= 7.0, < 7.0.1

CPE

  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

7 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-31615
NVD Published Date:
Apr 24, 2026
NVD Last Modified:
Jun 17, 2026
Source:
kernel.org
CVE-2026-31615 Details - Not Deferred