CVE-2026-98612: net: usb: catc: bound the RX packet length in catc_rx_done()
In the Linux kernel, the following vulnerability has been resolved:
net: usb: catc: bound the RX packet length in catcrxdone()
catcrxdone() walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen > urb->actuallength, ignores the header offset and compares against the whole transfer rather than the bytes left from pktstart, so a crafted packet header makes skbcopytolineardata() read past the buffer.
A length below ETHHLEN is also accepted, including zero, and ethtypetrans() then reads a MAC header from the uninitialised tailroom of a shorter skb. The isf5u011 branch takes its length straight from the transfer, so a zero-length URB reaches the same path.
Track the bytes remaining from the current packet, and reject a header that does not fit, a length past what is left, and a length below an Ethernet header.
A transfer shorter than an Ethernet header, including a zero-length one, previously became a runt skb passed to netifrx() and counted as received; it is now counted in rxlengtherrors and ends the walk.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In catc_rx_done(), track bytes remaining from the current packet and reject packet headers whose declared length is below ETH_HLEN or exceeds the bytes remaining in the transfer; count the packet as an rx_length_errors error and stop walking the multi-packet URB.