{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74681", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.925Z", "datePublished": "2026-08-22T15:32:48.873Z", "dateUpdated": "2026-08-22T15:32:48.873Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:32:48.873Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg\n\nibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check\nin usbio_bulk_msg() compares it against txbuf_len \u2014 the bulk OUT\nendpoint size. Both are taken independently from different endpoints\nin usbio_probe(), so the check is wrong when they differ.\n\nUse rxbuf_len for the IN direction. This matches the buffer that\nactually holds the response data."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/misc/usbio.c"], "versions": [{"version": "121a0f839dbb397af5fabb701cea3e9983223e50", "lessThan": "ebfd1e82ab0a6d26efd9bdd89de899215851f5bf", "status": "affected", "versionType": "git"}, {"version": "121a0f839dbb397af5fabb701cea3e9983223e50", "lessThan": "9ad0164f78b66b0b5eca3a5748cc94dd87e28124", "status": "affected", "versionType": "git"}, {"version": "121a0f839dbb397af5fabb701cea3e9983223e50", "lessThan": "7e22c9f79b200672f3e477421b6c9050d8cf70a5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/misc/usbio.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ebfd1e82ab0a6d26efd9bdd89de899215851f5bf"}, {"url": "https://git.kernel.org/stable/c/9ad0164f78b66b0b5eca3a5748cc94dd87e28124"}, {"url": "https://git.kernel.org/stable/c/7e22c9f79b200672f3e477421b6c9050d8cf70a5"}], "title": "usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/misc/usbio.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ebfd1e82ab0a6d26efd9bdd89de899215851f5bf", "status": "affected", "version": "121a0f839dbb397af5fabb701cea3e9983223e50", "versionType": "git"}, {"lessThan": "9ad0164f78b66b0b5eca3a5748cc94dd87e28124", "status": "affected", "version": "121a0f839dbb397af5fabb701cea3e9983223e50", "versionType": "git"}, {"lessThan": "7e22c9f79b200672f3e477421b6c9050d8cf70a5", "status": "affected", "version": "121a0f839dbb397af5fabb701cea3e9983223e50", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/misc/usbio.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg\n\nibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check\nin usbio_bulk_msg() compares it against txbuf_len \u2014 the bulk OUT\nendpoint size. Both are taken independently from different endpoints\nin usbio_probe(), so the check is wrong when they differ.\n\nUse rxbuf_len for the IN direction. This matches the buffer that\nactually holds the response data."}], "id": "CVE-2026-74681", "lastModified": "2026-08-22T16:16:42.373", "metrics": {}, "published": "2026-08-22T16:16:42.373", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7e22c9f79b200672f3e477421b6c9050d8cf70a5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9ad0164f78b66b0b5eca3a5748cc94dd87e28124"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ebfd1e82ab0a6d26efd9bdd89de899215851f5bf"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg", "id": "2521418", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521418"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nusb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg\nibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check\nin usbio_bulk_msg() compares it against txbuf_len \u2014 the bulk OUT\nendpoint size. Both are taken independently from different endpoints\nin usbio_probe(), so the check is wrong when they differ.\nUse rxbuf_len for the IN direction. This matches the buffer that\nactually holds the response data.", "A flaw was found in the Linux kernel's USB subsystem, specifically within the `usbio` module. An incorrect buffer size validation occurs in the `usbio_bulk_msg()` function, where the bulk IN (receive) buffer size is mistakenly compared against the bulk OUT endpoint size instead of the actual receive buffer size. This discrepancy can lead to an erroneous size check, potentially causing unexpected behavior or a denial of service when processing USB bulk messages."], "name": "CVE-2026-74681", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74681\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74681\nhttps://lore.kernel.org/linux-cve-announce/2026082231-CVE-2026-74681-f31c@gregkh/T"], "threat_severity": "Moderate"}