In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catc_rx_done() catc_rx_done()… (CVE-2026-98612)

The Linux kernel's catc USB network driver had a vulnerability in the catc_rx_done() function where the RX packet length was not correctly bounded. The function read a two-byte length from each packet header but compared it against the entire URB transfer length rather than the remaining bytes in the current packet, allowing crafted packets to cause skb_copy_to_linear_data() to read beyond buffer boundaries. Additionally, lengths below the Ethernet header length (ETH_HLEN), including zero, were accepted, causing eth_type_trans() to read uninitialized memory. The vulnerability also affected the is_f5u011 branch, where zero-length URBs could trigger the same issue. The patch tracks remaining bytes per packet, rejects headers that do not fit, lengths exceeding the remaining bytes, and lengths below the Ethernet header size. Transfers shorter than an Ethernet header are now counted as rx_length_errors and not passed to netif_rx().

This vulnerability could lead to out-of-bounds memory reads in kernel space, potentially exposing uninitialized memory or causing kernel memory corruption. Such behavior can undermine system stability or security, although no known exploits are reported. The issue affects the Linux kernel's USB network driver for catc devices and could impact systems using this driver.

A fix has been implemented in the Linux kernel to properly bound RX packet lengths in the catc_rx_done() function. Users should update their Linux kernel to a version that includes this patch. No additional mitigations are specified or required beyond applying the official fix.