CVE-2026-98612

Received Received - Intake

USB Buffer Overflow in Linux Kernel USB Driver

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catc_rx_done() catc_rx_done() walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pkt_len > urb->actual_length, ignores the header offset and compares against the whole transfer rather than the bytes left from pkt_start, so a crafted packet header makes skb_copy_to_linear_data() read past the buffer. A length below ETH_HLEN is also accepted, including zero, and eth_type_trans() then reads a MAC header from the uninitialised tailroom of a shorter skb. The is_f5u011 branch takes its length straight from the transfer, so a zero-length URB reaches the same path. Track the bytes remaining from the current packet, and reject a header that does not fit, a length past what is left, and a length below an Ethernet header. A transfer shorter than an Ethernet header, including a zero-length one, previously became a runt skb passed to netif_rx() and counted as received; it is now counted in rx_length_errors and ends the walk.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98612

EUVD

EUVD-2026-103657

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	2.6.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a buffer overflow in the catc USB network driver. The function catc_rx_done() incorrectly handles packet lengths during USB data transfers, allowing a crafted packet to cause out-of-bounds memory reads. Specifically, it fails to properly track remaining bytes in a multi-packet transfer, leading to reads beyond allocated buffers.

Detection Guidance

This vulnerability involves a buffer overflow in the Linux kernel's catc USB network driver. Detection requires checking for kernel versions affected by this issue and monitoring for unusual network traffic patterns or crashes related to USB network devices. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

An attacker could exploit this to crash the system or potentially execute arbitrary code with kernel privileges. It may also enable denial-of-service attacks by corrupting network processing. Systems using vulnerable Linux kernel versions with USB network adapters are at risk.

Compliance Impact

This vulnerability involves buffer over-reads and improper packet handling in the Linux kernel's USB network driver. While it does not directly impact compliance with standards like GDPR or HIPAA, it could potentially lead to data leaks or unauthorized access if exploited, which may indirectly affect compliance by compromising data integrity or confidentiality.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves the issue in catc_rx_done(). Disable or unplug affected USB network devices if an update is not immediately available. Monitor system logs for errors related to USB network drivers.

Hi! I’m here to help you understand CVE-2026-98612. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70