CVE-2026-98612

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: catc: bound the RX packet length in catc_rx_done()

catc_rx_done() walks a multi-packet URB, reading a two-byte length from

each packet header. Its bound, pkt_len > urb->actual_length, ignores the

header offset and compares against the whole transfer rather than the

bytes left from pkt_start, so a crafted packet header makes

skb_copy_to_linear_data() read past the buffer.

A length below ETH_HLEN is also accepted, including zero, and

eth_type_trans() then reads a MAC header from the uninitialised tailroom

of a shorter skb. The is_f5u011 branch takes its length straight from

the transfer, so a zero-length URB reaches the same path.

Track the bytes remaining from the current packet, and reject a header

that does not fit, a length past what is left, and a length below an

Ethernet header.

A transfer shorter than an Ethernet header, including a zero-length one,

previously became a runt skb passed to netif_rx()

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References