Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-74681

usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT endpoint size. Both are taken independently from different endpoints in usbio_probe(), so the check is wrong when they differ. Use rxbuf_len for the IN direction. This matches the buffer that actually holds the response data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 121a0f839dbb397af5fabb701cea3e9983223e50 to < ebfd1e82ab0a6d26efd9bdd89de899215851f5bfaffected
  • 121a0f839dbb397af5fabb701cea3e9983223e50 to < 9ad0164f78b66b0b5eca3a5748cc94dd87e28124affected
  • 121a0f839dbb397af5fabb701cea3e9983223e50 to < 7e22c9f79b200672f3e477421b6c9050d8cf70a5affected

Linux Linux

Default version status: affected

  • 6.18affected
  • 0 to < 6.18unaffected
  • 6.18.45 to ≤ 6.18.*unaffected
  • 7.1.9 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References