Heap out-of-bounds write in Linux kernel usbip_pack_ret_submit()

CVE-2026-31607 is a Linux kernel USB/IP client-side memory corruption vulnerability in the handling of RET_SUBMIT responses for isochronous URBs. In usbip_pack_ret_submit(), the client unconditionally overwrites urb->number_of_packets with the number_of_packets value received from the network PDU. That field is later used as the loop bound in usbip_recv_iso() and usbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible array whose size was fixed when the URB was originally allocated based on the number_of_packets from the earlier CMD_SUBMIT request. A malicious USB/IP server can return a RET_SUBMIT response with number_of_packets larger than the original submitted value, causing usbip_recv_iso() to write past the end of urb->iso_frame_desc[] and trigger a heap out-of-bounds write. The issue was confirmed by KASAN on kernel 7.0.0-rc5 as a slab-out-of-bounds write in usbip_recv_iso(). The fix adds validation in usbip_pack_ret_submit() to ensure rpdu->number_of_packets does not exceed the original urb->number_of_packets before overwriting it; invalid values are clamped to zero so downstream receive/padding paths return safely.