CVE-2026-74681

A flaw was found in the Linux kernel's USB subsystem, specifically within the usbio module. An incorrect buffer size validation occurs in the usbiobulkmsg function, where the bulk IN receive buffer size is mistakenly compared against the bulk OUT endpoint size instead of the actual receive buffer...

The vulnerability of the usbio_probe() function in the drivers/usb/misc/usbio.c file of the Linux operating system’s USB device driver module allows a hacker to cause a service failure.

The vulnerability of the usbioprobe function in the drivers/usb/misc/usbio.c file of the Linux device driver module is related to improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...

SUSE CVE-2026-74681

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen - the bulk OUT endpoint size. Both are taken independent...

CVE-2026-74681

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen — the bulk OUT endpoint size. Both are taken independent...

CVE-2026-74681

CVE-2026-74681 is a bug in the Linux kernel usbio driver (under drivers/usb/misc/). In usbio_bulk_msg(), the EMSGSIZE check incorrectly compares ibuf_len (the bulk IN/receive buffer size) against txbuf_len (the bulk OUT endpoint size) instead of rxbuf_len. Both values are set independently from d...

CVE-2026-74681 usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen — the bulk OUT endpoint size. Both are taken independent...

EUVD-2026-64368

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen — the bulk OUT endpoint size. Both are taken independent...

CVE-2026-74681 usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen — the bulk OUT endpoint size. Both are taken independent...

PT-2026-79686

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuf len against rxbuf len in bulk msg ibuf len is the bulk IN receive buffer size, but the EMSGSIZE check in usbio bulk msg compares it against txbuf len — the bulk OUT endpoint size. Both are taken...

Linux Distros Unpatched Vulnerability : CVE-2026-74681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it...

CVE-2026-64453

A flaw was found in the Linux kernel's USB subsystem, specifically within the usbio module. This vulnerability, known as a use-after-free UAF, occurs when the system attempts to access memory that has already been released during the disconnection of a USB device. A local attacker or a specially...

SUSE CVE-2026-64339

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbiobulkmsg copies bpktlen = le16tocpubpkt-len bytes out of the bulk IN buffer usbio-rxbuf, allocated with size usbio-rxbuflen into the caller's buffer...

CVE-2026-64339

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbiobulkmsg copies bpktlen = le16tocpubpkt-len bytes out of the bulk IN buffer usbio-rxbuf, allocated with size usbio-rxbuflen into the caller's buffer...

CVE-2026-64339

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbiobulkmsg copies bpktlen = le16tocpubpkt-len bytes out of the bulk IN buffer usbio-rxbuf, allocated with size usbio-rxbuflen into the caller's buffer...

CVE-2026-64453

A use-after-free in the Linux kernel's usbio USB driver occurs during device disconnection. When usbio_disconnect() iterates the client list in reverse, auxiliary_device_uninit() can free the current struct usbio_client, causing the list_for_each_entry_reverse() iterator to dereference freed memo...

CVE-2026-64453 usb: misc: usbio: fix disconnect UAF in client teardown

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbiodisconnect walks usbio-clilist in reverse and uninitializes each auxiliary device. auxiliarydeviceuninit drops the device reference, and for an unbound child that can r...

CVE-2026-64453

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbiodisconnect walks usbio-clilist in reverse and uninitializes each auxiliary device. auxiliarydeviceuninit drops the device reference, and for an unbound child that can r...

EUVD-2026-48797

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbiodisconnect walks usbio-clilist in reverse and uninitializes each auxiliary device. auxiliarydeviceuninit drops the device reference, and for an unbound child that can r...

CVE-2026-64453 usb: misc: usbio: fix disconnect UAF in client teardown

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbiodisconnect walks usbio-clilist in reverse and uninitializes each auxiliary device. auxiliarydeviceuninit drops the device reference, and for an unbound child that can r...

EUVD-2026-48883

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbiobulkmsg copies bpktlen = le16tocpubpkt-len bytes out of the bulk IN buffer usbio-rxbuf, allocated with size usbio-rxbuflen into the caller's buffer...