CVE-2026-74681: usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
In the Linux kernel, the following vulnerability has been resolved:
usb: misc: usbio: check ibuflen against rxbuflen in bulk msg
ibuflen is the bulk IN (receive) buffer size, but the EMSGSIZE check in usbiobulkmsg() compares it against txbuflen — the bulk OUT endpoint size. Both are taken independently from different endpoints in usbioprobe(), so the check is wrong when they differ.
Use rxbuflen for the IN direction. This matches the buffer that actually holds the response data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which USBIO endpoint configurations need attention?
The unsafe condition is relevant when the bulk OUT endpoint size, used as txbuf_len, is larger than the bulk IN endpoint size, used as rxbuf_len. In that case, a receive length can pass the incorrect comparison while exceeding the buffer that holds response data.
How can I determine whether a device-driver pairing is exposed?
Inspect the bulk IN and bulk OUT endpoint sizes obtained by usbio_probe() and compare the resulting rxbuf_len and txbuf_len values. Systems where the receive buffer is smaller than the transmit buffer require the corrected IN-direction length check.