CVE-2026-98769
Received
Received - Intake
Out-of-Bounds Access in Linux Kernel USB Gadget Driver
Vulnerability report for CVE-2026-98769, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-18
Last updated on: 2026-10-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
generic_set_cmd() and generic_get_cmd() use the low nibble of
ctrl->bRequest as an index into con->data[]:
u8 cmd = (ctrl->bRequest & 0x0F); /* 0 .. 15 */
...
con->data[cmd] = value; /* OOB when cmd >= 5 */
struct usb_audio_control (include/linux/usb/audio.h) declares data as
a 5-element array, so indices 5 through 15 write (or read) up to 44
bytes past the end of the array on the heap.
A malicious USB host can craft a class-specific SET_CUR / GET_CUR
request with an arbitrary bRequest value, triggering the out-of-bounds
access from an IRQ completion handler with no further preconditions.
Add an ARRAY_SIZE() guard to both functions.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | c47d7b09891abb4f8b222317c89c7469bed8db3a |
| Linux | Linux | c47d7b09891abb4f8b222317c89c7469bed8db3a |
| Linux | Linux | c47d7b09891abb4f8b222317c89c7469bed8db3a |
| Linux | Linux | c47d7b09891abb4f8b222317c89c7469bed8db3a |
| Linux | Linux | 2.6.31 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
