CVE-2026-97539: usb: xusbatm: don't rely on id table pointer arithmetic
In the Linux kernel, the following vulnerability has been resolved:
usb: xusbatm: don't rely on id table pointer arithmetic
The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that is wildly out of bound. xusbatm initialize the USB device IDs dynamically so it can just use driverinfo too.
Even with conversion, xusbatm still cannot support dynamic IDs, so also set nodynamicid.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Set no_dynamic_id to prevent dynamic IDs.
xusbatm no_dynamic_id = set
Event History
Frequently Asked Questions
What condition triggers the faulty code path?
The issue is triggered when the xusbatm USB driver is used with a dynamic USB ID. In that case, the probe callback receives a usb_device_id allocated on the heap, making the driver's ID-table pointer arithmetic produce an out-of-bounds index.
Are dynamically added USB IDs supported by this driver after the fix?
No. The fix changes xusbatm to use driver_info and sets no_dynamic_id, so the driver does not support dynamic USB IDs.
How can I determine whether this affects my deployment?
Determine whether the Linux kernel's xusbatm USB driver is present and whether it has been used with a dynamic USB ID. The vulnerable behavior specifically depends on dynamic-ID handling rather than normal statically initialized device IDs.