CVE-2026-98025: net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
In the Linux kernel, the following vulnerability has been resolved:
net: usb: cx82310eth: drop URB after 0xffff reboot sentinel to prevent partialdata heap overflow
The 0xffff length sentinel detects a router reboot and schedules re-enabling of ethernet mode, but then falls through to the rest of the loop body. The next check is
} else if (len > CX82310MTU) {
which is the else of the just-matched if -- it never fires for len == 0xffff. The MTU bound that normally caps the incomplete-packet save path is silently bypassed.
With 0xffff > skb->len always true (rxurbsize is 4096), the incomplete-packet branch saves dev->partiallen = skb->len bytes into dev->partialdata. partialdata is kmalloc(hardmtu) = kmalloc(CX82310MTU + 2) = 1516 bytes, but skb->len after the 2-byte header pull can be up to 4094. A device that sends a 4096-byte URB starting with [0xff 0xff] therefore copies 4094 device-provided bytes into a buffer allocated for 1516 bytes, exceeding its requested size by 2578 bytes.
The next URB then reads dev->partiallen (4094) back from the same 1516-byte buffer and dev->partialrem (65535 - 4094 = 61441) from the new URB's ~4KB skb, both well past their allocations, and delivers the spliced result as a 64KB "frame" to the network stack.
Bail out of rxfixup after scheduling the re-enable work; the remainder of a reboot-marker URB is not meaningful packet data. This restores the invariant that partiallen < CX82310MTU + 2 on the save path, since every other route there has already passed the MTU check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In net: usb: cx82310_eth, drop the URB when the 0xffff reboot-length sentinel is detected, rather than processing the remainder as packet data.
Event History
Frequently Asked Questions
Which systems are exposed to this condition?
The issue is in the Linux kernel's cx82310_eth USB Ethernet driver. Exposure requires use of that driver with a device capable of supplying the affected USB receive data.
What input sequence triggers the memory corruption?
A received 4096-byte URB beginning with the two-byte 0xffff reboot sentinel can bypass the normal MTU bound. After the header is removed, up to 4094 bytes are copied into partial_data, which is allocated for 1516 bytes.
What happens after the oversized partial packet is saved?
The copy can exceed the requested partial_data allocation by 2578 bytes. Processing the following URB can then read both the saved partial length and remaining length beyond their respective allocations.