In the Linux kernel, the following vulnerability has been resolved: net: usb: sr9700: include receive overhead in the length check The receive fixup… (CVE-2026-98597)

The vulnerability in the Linux kernel's net: usb: sr9700 driver involved the receive fixup logic, which subtracted the Ethernet CRC from the reported packet length but compared the payload length against the entire remaining receive buffer. This mismatch could cause the copy operation to proceed incorrectly after the three-byte header and four-byte CRC, potentially leading to memory corruption. The fix requires the payload to fit after the SR_RX_OVERHEAD before copying or advancing to the next packet. The loop logic ensures the remaining buffer is larger than the overhead, making the subtraction safe. This issue was detected by static analysis tools and has been resolved in the kernel source.

The vulnerability could lead to incorrect memory handling during USB packet reception in the sr9700 driver, which might cause memory corruption or instability in the kernel network stack. No known exploits in the wild have been reported. The impact is limited to affected Linux kernel versions containing this flawed driver code.

A fix has been implemented in the Linux kernel to correctly include receive overhead in the length check for the net: usb: sr9700 driver. Users should update to the patched kernel version once available. Since this is a kernel-level fix, applying the official kernel update from the Linux distribution vendor is the recommended remediation.