An out-of-bounds write flaw exists in usbredir within Red Hat Enterprise Linux 10. Specifically, initiating an isochronous OUT stream with a transfer count of 1 causes the single transfer buffer to remain unsubmitted, defeating the bounds check in usbredirhost_iso_packet(). This enables a usbredir peer to write past the end of the packet descriptor array on every subsequent isochronous packet, leading to heap corruption. The vulnerability is tracked as CVE-2026-92382 and has a CVSS v3.1 base score of 4.1 (medium severity) with an attack vector of local, high attack complexity, and high privileges required. The impact is primarily denial of service due to potential crashes or restarts from memory corruption.

The vulnerability allows a local attacker with high privileges to cause out-of-bounds writes in memory, which can lead to denial of service by crashing or restarting the affected system. There is no impact on confidentiality or integrity reported. The flaw affects availability by causing unexpected states or crashes due to heap corruption.

Red Hat recommends removing the 'usbredir' package if USB redirection is not required, which eliminates the attack surface. This may affect functionality relying on USB device redirection, especially in virtualized environments. No official fix or patch status is confirmed yet; users should monitor the Red Hat advisory for updates. Since this is a local vulnerability requiring high privileges, limiting access to trusted users and disabling unnecessary USB redirection features can reduce risk.