CVE-2026-74681
N/A
N/A
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT endpoint size. Both are taken independently from different endpoints in usbio_probe(), so the check is wrong when they differ.
Use rxbuf_len for the IN direction. This matches the buffer that actually holds the response data.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 121a0f839dbb397af5fabb701cea3e9983223e50 < ebfd1e82ab0a6d26efd9bdd89de899215851f5bf | affected |
| Linux | Linux | 121a0f839dbb397af5fabb701cea3e9983223e50 < 9ad0164f78b66b0b5eca3a5748cc94dd87e28124 | affected |
| Linux | Linux | 121a0f839dbb397af5fabb701cea3e9983223e50 < 7e22c9f79b200672f3e477421b6c9050d8cf70a5 | affected |
| Linux | Linux | 6.18 | affected |
| Linux | Linux | 0 < 6.18 | unaffected |
| Linux | Linux | 6.18.45 <= 6.18.* | unaffected |
| Linux | Linux | 7.1.9 <= 7.1.* | unaffected |
| Linux | Linux | 7.2 <= * | unaffected |
Weaknesses
References
- https://git.kernel.org/stable/c/ebfd1e82ab0a6d26efd9bdd89de899215851f5bf
- https://git.kernel.org/stable/c/9ad0164f78b66b0b5eca3a5748cc94dd87e28124
- https://git.kernel.org/stable/c/7e22c9f79b200672f3e477421b6c9050d8cf70a5
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.