Linux CVE-2026-31720

Local privilege escalation via stack out-of-bounds write affects the f_uac1_legacy USB Audio Class 1.0 gadget driver in the Linux kernel, where f_audio_complete() memcpy's a host-controlled req->length into a fixed 4-byte stack variable without validation. A device operating in USB gadget/peripheral mode can be driven by a malicious or crafted USB host to corrupt kernel stack memory, yielding CVSS 7.8 (High) with full confidentiality, integrity and availability impact. No public exploit is identified at time of analysis and EPSS is negligible (0.02%), but the flaw is upstream-patched across many stable trees.