CVE-2026-98025
Received Received - Intake

Heap Overflow in Linux Kernel USB Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow The 0xffff length sentinel detects a router reboot and schedules re-enabling of ethernet mode, but then falls through to the rest of the loop body. The next check is } else if (len > CX82310_MTU) { which is the else of the just-matched if -- it never fires for len == 0xffff. The MTU bound that normally caps the incomplete-packet save path is silently bypassed. With 0xffff > skb->len always true (rx_urb_size is 4096), the incomplete-packet branch saves dev->partial_len = skb->len bytes into dev->partial_data. partial_data is kmalloc(hard_mtu) = kmalloc(CX82310_MTU + 2) = 1516 bytes, but skb->len after the 2-byte header pull can be up to 4094. A device that sends a 4096-byte URB starting with [0xff 0xff] therefore copies 4094 device-provided bytes into a buffer allocated for 1516 bytes, exceeding its requested size by 2578 bytes. The next URB then reads dev->partial_len (4094) back from the same 1516-byte buffer and dev->partial_rem (65535 - 4094 = 61441) from the new URB's ~4KB skb, both well past their allocations, and delivers the spliced result as a 64KB "frame" to the network stack. Bail out of rx_fixup after scheduling the re-enable work; the remainder of a reboot-marker URB is not meaningful packet data. This restores the invariant that partial_len < CX82310_MTU + 2 on the save path, since every other route there has already passed the MTU check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98025
EUVD
EUVD-2026-86678

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a heap overflow in the cx82310_eth USB network driver. When a router reboots, it sends a special 0xffff length sentinel to trigger re-enabling ethernet mode. However, the code fails to properly handle this sentinel, bypassing a critical size check. This allows a maliciously crafted USB packet to overflow a 1516-byte buffer by writing up to 4094 bytes, potentially leading to memory corruption or arbitrary code execution.

Detection Guidance

This vulnerability affects the Linux kernel's cx82310_eth USB network driver. Detection requires checking if the affected driver is loaded and monitoring for unusual network traffic patterns or crashes related to USB network devices. No specific commands are provided in the context to detect this issue.

Impact Analysis

If exploited, this vulnerability could allow an attacker with physical access to a vulnerable system to cause a denial of service, execute arbitrary code with kernel privileges, or gain unauthorized access to the system. It specifically targets systems using the cx82310_eth USB network adapter.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Since this is a kernel driver vulnerability, updating to a patched kernel version is the primary mitigation. Monitor vendor advisories for updates to the cx82310_eth driver.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98025. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart