CVE-2026-31720 is a high-severity vulnerability in the Linux kernel's USB gadget f_uac1_legacy driver. It involves improper validation of the control request size, where a host-controlled length value is used to copy data into a fixed 4-byte stack buffer, leading to a potential stack out-of-bounds write. This flaw could allow an attacker with local access to cause memory corruption with high impact on confidentiality, integrity, and availability. The vulnerability has been resolved by validating the actual request size against expected payload sizes and limiting the copied data accordingly.