4 matches found
EUVD-2026-103657
In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen urb-actuallength, ignores the header offset and compares against t...
CVE-2026-98612 net: usb: catc: bound the RX packet length in catc_rx_done()
In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen urb-actuallength, ignores the header offset and compares against t...
CVE-2026-98612
The Linux kernel contains a vulnerability in the net: usb: catc component within the catc_rx_done() function. The root cause is an improper bound check where pkt_len > urb->actual_length ignores the header offset and compares against the entire transfer instead of the remaining bytes. This ...
