VulnerabilityPublished 18 Oct 2026

CVE-2026-98612: Linux kernel · net: usb: catc: bound the RX packet length in catc_rx_done()

Source GCVE Database

Authoritative record:CVE-2026-98612· High

Not known to be exploited · fixed in dd9c6f8f05170223edec2dac476606cd40d9acb7 : patch Linux kernel soon.

Data as of 26 Oct 2026, 14:05 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 8% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in dd9c6f8f05170223edec2dac476606cd40d9acb7, 3942557938f846e7481f6ccb2b41ccbdee61baa1, 801e21cf7dd6bcee31db907625d5045f21c9c1d9 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-xhrr-qp73-mj8c

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < dd9c6f8f05170223edec2dac476606cd40d9acb7	Fixed in dd9c6f8f05170223edec2dac476606cd40d9acb7
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 3942557938f846e7481f6ccb2b41ccbdee61baa1	Fixed in 3942557938f846e7481f6ccb2b41ccbdee61baa1
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 801e21cf7dd6bcee31db907625d5045f21c9c1d9	Fixed in 801e21cf7dd6bcee31db907625d5045f21c9c1d9
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 21e206dd88b3de6e36bb607dec3797c59bc3007b	Fixed in 21e206dd88b3de6e36bb607dec3797c59bc3007b
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 9d565b6b72fe3f41fd43636e143072848105189f	Fixed in 9d565b6b72fe3f41fd43636e143072848105189f
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 9d4be026bdff2c1da7b6c7e01c0a47f2df409e97	Fixed in 9d4be026bdff2c1da7b6c7e01c0a47f2df409e97

AI-suggested

A fix has been implemented in the Linux kernel to properly bound RX packet lengths in the catc_rx_done() function. Users should update their Linux kernel to a version that includes this patch. No additional mitigations are specified or required beyond applying the official fix.

Description

A vulnerability in the Linux kernel's USB network driver for catc devices was resolved by properly bounding the RX packet length in the catc_rx_done() function. The flaw allowed crafted packet headers to cause out-of-bounds reads, potentially leading to reading uninitialized memory or buffer overflows. The fix involves stricter validation of packet lengths and rejecting malformed packets, preventing runt packets from being processed.

Impact

This vulnerability could lead to out-of-bounds memory reads in kernel space, potentially exposing uninitialized memory or causing kernel memory corruption. Such behavior can undermine system stability or security, although no known exploits are reported. The issue affects the Linux kernel's USB network driver for catc devices and could impact systems using this driver.

Summary

The Linux kernel's catc USB network driver had a vulnerability in the catc_rx_done() function where the RX packet length was not correctly bounded. The function read a two-byte length from each packet header but compared it against the entire URB transfer length rather than the remaining bytes in the current packet, allowing crafted packets to cause skb_copy_to_linear_data() to read beyond buffer boundaries. Additionally, lengths below the Ethernet header length (ETH_HLEN), including zero, were accepted, causing eth_type_trans() to read uninitialized memory. The vulnerability also affected the is_f5u011 branch, where zero-length URBs could trigger the same issue. The patch tracks remaining bytes per packet, rejects headers that do not fit, lengths exceeding the remaining bytes, and lengths below the Ethernet header size. Transfers shorter than an Ethernet header are now counted as rx_length_errors and not passed to netif_rx().

References

Community reviews

Loading reviews…