Cloudanix VulnDB

CVE-2026-98612

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A USB network adapter driver in the Linux kernel can be tricked by a bad packet into reading memory it should not, which may crash the system or leak data.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in catc_rx_done() when processing multi-packet USB RX URBs: pkt_len bounds check compares against total urb->actual_length instead of remaining bytes from pkt_start, and accepts lengths below ETH_HLEN (including zero), allowing skb_copy_to_linear_data() to read past the allocated skb and eth_type_trans() to access uninitialized tailroom.

Why it matters to the business

Systems using CATC USB Ethernet adapters may experience kernel memory corruption, crashes, or information disclosure leading to loss of network connectivity and potential system instability.

How an attack unfolds

An attacker supplies a malicious USB device or crafts network traffic that delivers a multi-packet URB containing an oversized or undersized length field in the packet header; the driver accepts the invalid length, performs an out-of-bounds memory copy, and either reads past the buffer or passes a runt skb to netif_rx().

How to fix it

Apply the upstream kernel fix that tracks remaining bytes from each packet header, rejects lengths that do not fit or are below ETH_HLEN, and counts invalid transfers as rx_length_errors; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the presence of the commit message referencing bounded RX packet length in catc_rx_done(); test with a zero-length or oversized header URB and verify that rx_length_errors increments instead of producing a runt skb.

Typical attack path

  1. Attach or emulate a CATC USB Ethernet device that generates a crafted multi-packet RX URB
  2. Supply a packet header whose two-byte length field either exceeds remaining URB bytes or is smaller than ETH_HLEN
  3. Trigger skb_copy_to_linear_data() or eth_type_trans() on the resulting malformed skb
  4. Observe kernel oops, information leak, or silent corruption during netif_rx()

How to detect it

Search kernel logs and dmesg for catc_rx_done errors, rx_length_errors counter increases, skb allocation warnings, or oops traces referencing eth_type_trans or skb_copy_to_linear_data after USB device insertion.

What your security team should do

  • Identify hosts that load the catc kernel module and schedule immediate kernel updates
  • Disable the catc driver via modprobe blacklist if the hardware is not required
  • Monitor kernel logs for rx_length_errors spikes after patching

The record

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catc_rx_done() catc_rx_done() walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pkt_len > urb->actual_length, ignores the header offset and compares against the whole transfer rather than the bytes left from pkt_start, so a crafted packet header makes skb_copy_to_linear_data() read past the buffer. A length below ETH_HLEN is also accepted, including zero, and eth_type_trans() then reads a MAC header from the uninitialised tailroom of a shorter skb. The is_f5u011 branch takes its length straight from the transfer, so a zero-length URB reaches the same path. Track the bytes remaining from the current packet, and reject a header that does not fit, a length past what is left, and a length below an Ethernet header. A transfer shorter than an Ethernet header, including a zero-length one, previously became a runt skb passed to netif_rx() and counted as received; it is now counted in rx_length_errors and ends the walk.

Affected packages

Ecosystem Package Introduced Fixed