A flaw in the Linux kernel USB gadget Phonet driver allows an attacker to send a sequence of full-page OUT transfers that causes the kernel’s skb_shared_info->frags array to overflow. Each transfer adds a fragment and once the number of fragments exceeds MAX_SKB_FRAGS (default 17), subsequent fragment stores overwrite memory adjacent to the sk_buff helper structure. This results in an out‑of‑bounds write (CWE‑787) and can lead to memory corruption. The kernel also drops the skb and reports a length error when the limit is reached, preventing a memory leak (CWE‑401). The vulnerability exists in any Linux kernel that includes the Phonet gadget driver. No specific kernel version is listed, so all builds containing the unpatched driver are considered vulnerable. The exploit is limited to devices exposing Phonet functionality and interacting with USB hosts capable of sending crafted OUT packets. The CVSS score of 5.5 denotes medium severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation at present. The vulnerability is not in CISA KEV. Exploitation requires a USB host that can communicate with the gadget and send exact PAGE_SIZE bytes on each transfer, so the attack vector is local and requires physical or logical access to the USB interface.

All Linux kernel builds that include the Phonet gadget driver are affected. The vendor is the Linux kernel project. No specific version information is provided, so any kernel containing the unpatched driver may be vulnerable. Devices that expose Phonet functionality and connect to a USB host capable of sending numerous full‑page OUT transfers are within scope.

With a CVSS score of 5.5 the vulnerability rates as medium severity, and the EPSS score of less than 1% suggests exploitation chances are minimal. The vulnerability is not listed in the CISA KEV catalog. Because the overflow occurs only when a host sends a sequence of full‑page OUT transfers that exceed the fragment limit, the required conditions involve a USB host with direct access to the gadget. Successful exploitation could corrupt kernel memory, potentially leading to kernel crashes or privilege escalation, but no confirmed remote code execution is documented.