CVE-2026-97539: usb: xusbatm: don't rely on id table pointer arithmetic
In the Linux kernel, the following vulnerability has been resolved:
usb: xusbatm: don't rely on id table pointer arithmetic
The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that is wildly out of bound. xusbatm initialize the USB device IDs dynamically so it can just use driverinfo too.
Even with conversion, xusbatm still cannot support dynamic IDs, so also set nodynamicid.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set driver_info to no_dynamic_id and initialize the USB device IDs dynamically so xusbatm does not rely on USB device ID table pointer arithmetic.
Linux kernel USB xusbatm driver driver_info = no_dynamic_id
Event History
Frequently Asked Questions
What condition triggers the faulty code path?
The issue is triggered when the xusbatm USB driver is used with a dynamic USB ID. In that case, the probe callback receives a usb_device_id allocated on the heap, making the driver's ID-table pointer arithmetic produce an out-of-bounds index.
Are dynamically added USB IDs supported by this driver after the fix?
No. The fix changes xusbatm to use driver_info and sets no_dynamic_id, so the driver does not support dynamic USB IDs.
How can I determine whether this affects my deployment?
Determine whether the Linux kernel's xusbatm USB driver is present and whether it has been used with a dynamic USB ID. The vulnerable behavior specifically depends on dynamic-ID handling rather than normal statically initialized device IDs.