CVE-2026-68366: usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: clamp SENDRESPONSE length to the response buffer
uvcsendresponse() builds the UVC control response from a user-supplied struct uvcrequestdata:
req->length = mint(unsigned int, uvc->eventlength, data->length); ... memcpy(req->buf, data->data, req->length);
req->length is clamped to uvc->eventlength, which is taken from the host control request wLength (up to UVCMAXREQUESTSIZE, 64), and to data->length, which comes from the UVCIOCSENDRESPONSE ioctl and is only checked for being negative. The source buffer data->data is only 60 bytes, so a response with uvc->eventlength and data->length both greater than 60 makes memcpy() read past the end of data->data.
Clamp req->length to sizeof(data->data) as well.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In uvc_send_response(), clamp the user-supplied SEND_RESPONSE length before memcpy(): set req->length = min_t(unsigned int, uvc->event_length, data->length) and ensure it is clamped to the response buffer capacity (e.g., clamp req->length to sizeof(data->data) / the available response buffer size) so memcpy(req->buf, data->data, req->length) cannot read past data->data.
Linux kernel UVC gadget driver (usb: gadget: uvc) SEND_RESPONSE response length clamping = req->length = min_t(unsigned int, uvc->event_length, data->length) and clamp to response buffer size
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68366?
The severity of CVE-2026-68366 is risk 37.
How do I fix CVE-2026-68366?
To fix CVE-2026-68366, update to the latest version of the Linux kernel that includes the patch.
What systems are affected by CVE-2026-68366?
CVE-2026-68366 affects systems running the vulnerable versions of the Linux kernel that implement UVC gadget functionality.
What is the impact of CVE-2026-68366?
CVE-2026-68366 could allow an attacker to exploit improper handling of response lengths in UVC control responses.
When was CVE-2026-68366 publicly disclosed?
CVE-2026-68366 was published on August 10, 2026.