{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98612", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.360Z", "datePublished": "2026-10-18T15:19:32.790Z", "dateUpdated": "2026-10-19T09:22:40.233Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:40.233Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: catc: bound the RX packet length in catc_rx_done()\n\ncatc_rx_done() walks a multi-packet URB, reading a two-byte length from\neach packet header. Its bound, pkt_len > urb->actual_length, ignores the\nheader offset and compares against the whole transfer rather than the\nbytes left from pkt_start, so a crafted packet header makes\nskb_copy_to_linear_data() read past the buffer.\n\nA length below ETH_HLEN is also accepted, including zero, and\neth_type_trans() then reads a MAC header from the uninitialised tailroom\nof a shorter skb. The is_f5u011 branch takes its length straight from\nthe transfer, so a zero-length URB reaches the same path.\n\nTrack the bytes remaining from the current packet, and reject a header\nthat does not fit, a length past what is left, and a length below an\nEthernet header.\n\nA transfer shorter than an Ethernet header, including a zero-length one,\npreviously became a runt skb passed to netif_rx() and counted as\nreceived; it is now counted in rx_length_errors and ends the walk."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/usb/catc.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "3942557938f846e7481f6ccb2b41ccbdee61baa1", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "2f87bbd5a7bf6ee79d598f7e22cf77810d29ae87", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "4cc0a8eb2f9336cfa3e4ac329bc5585ca970ced3", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "21e206dd88b3de6e36bb607dec3797c59bc3007b", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "801e21cf7dd6bcee31db907625d5045f21c9c1d9", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "dd9c6f8f05170223edec2dac476606cd40d9acb7", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "9d4be026bdff2c1da7b6c7e01c0a47f2df409e97", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "9d565b6b72fe3f41fd43636e143072848105189f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/usb/catc.c"], "versions": [{"version": "2.6.12", "status": "affected"}, {"version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3942557938f846e7481f6ccb2b41ccbdee61baa1"}, {"url": "https://git.kernel.org/stable/c/2f87bbd5a7bf6ee79d598f7e22cf77810d29ae87"}, {"url": "https://git.kernel.org/stable/c/4cc0a8eb2f9336cfa3e4ac329bc5585ca970ced3"}, {"url": "https://git.kernel.org/stable/c/21e206dd88b3de6e36bb607dec3797c59bc3007b"}, {"url": "https://git.kernel.org/stable/c/801e21cf7dd6bcee31db907625d5045f21c9c1d9"}, {"url": "https://git.kernel.org/stable/c/dd9c6f8f05170223edec2dac476606cd40d9acb7"}, {"url": "https://git.kernel.org/stable/c/9d4be026bdff2c1da7b6c7e01c0a47f2df409e97"}, {"url": "https://git.kernel.org/stable/c/9d565b6b72fe3f41fd43636e143072848105189f"}], "title": "net: usb: catc: bound the RX packet length in catc_rx_done()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/usb/catc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3942557938f846e7481f6ccb2b41ccbdee61baa1", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "2f87bbd5a7bf6ee79d598f7e22cf77810d29ae87", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "4cc0a8eb2f9336cfa3e4ac329bc5585ca970ced3", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "21e206dd88b3de6e36bb607dec3797c59bc3007b", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "801e21cf7dd6bcee31db907625d5045f21c9c1d9", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "dd9c6f8f05170223edec2dac476606cd40d9acb7", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "9d4be026bdff2c1da7b6c7e01c0a47f2df409e97", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "9d565b6b72fe3f41fd43636e143072848105189f", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/usb/catc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.12"}, {"lessThan": "2.6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: catc: bound the RX packet length in catc_rx_done()\n\ncatc_rx_done() walks a multi-packet URB, reading a two-byte length from\neach packet header. Its bound, pkt_len > urb->actual_length, ignores the\nheader offset and compares against the whole transfer rather than the\nbytes left from pkt_start, so a crafted packet header makes\nskb_copy_to_linear_data() read past the buffer.\n\nA length below ETH_HLEN is also accepted, including zero, and\neth_type_trans() then reads a MAC header from the uninitialised tailroom\nof a shorter skb. The is_f5u011 branch takes its length straight from\nthe transfer, so a zero-length URB reaches the same path.\n\nTrack the bytes remaining from the current packet, and reject a header\nthat does not fit, a length past what is left, and a length below an\nEthernet header.\n\nA transfer shorter than an Ethernet header, including a zero-length one,\npreviously became a runt skb passed to netif_rx() and counted as\nreceived; it is now counted in rx_length_errors and ends the walk."}], "id": "CVE-2026-98612", "lastModified": "2026-10-19T10:19:23.413", "metrics": {}, "published": "2026-10-18T16:17:14.030", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/21e206dd88b3de6e36bb607dec3797c59bc3007b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2f87bbd5a7bf6ee79d598f7e22cf77810d29ae87"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3942557938f846e7481f6ccb2b41ccbdee61baa1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4cc0a8eb2f9336cfa3e4ac329bc5585ca970ced3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/801e21cf7dd6bcee31db907625d5045f21c9c1d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9d4be026bdff2c1da7b6c7e01c0a47f2df409e97"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9d565b6b72fe3f41fd43636e143072848105189f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dd9c6f8f05170223edec2dac476606cd40d9acb7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: usb: catc: bound the RX packet length in catc_rx_done()", "id": "2555025", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555025"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: usb: catc: bound the RX packet length in catc_rx_done()\ncatc_rx_done() walks a multi-packet URB, reading a two-byte length from\neach packet header. Its bound, pkt_len > urb->actual_length, ignores the\nheader offset and compares against the whole transfer rather than the\nbytes left from pkt_start, so a crafted packet header makes\nskb_copy_to_linear_data() read past the buffer.\nA length below ETH_HLEN is also accepted, including zero, and\neth_type_trans() then reads a MAC header from the uninitialised tailroom\nof a shorter skb. The is_f5u011 branch takes its length straight from\nthe transfer, so a zero-length URB reaches the same path.\nTrack the bytes remaining from the current packet, and reject a header\nthat does not fit, a length past what is left, and a length below an\nEthernet header.\nA transfer shorter than an Ethernet header, including a zero-length one,\npreviously became a runt skb passed to netif_rx() and counted as\nreceived; it is now counted in rx_length_errors and ends the walk.", "A flaw was found in the Linux kernel's CATC USB Ethernet driver. The driver fails to properly validate packet length boundaries when processing incoming multi-packet network transfers. An attacker could exploit this flaw by providing crafted packet headers, causing the driver to read beyond the allocated buffer or read uninitialized memory. This vulnerability primarily results in a system crash, leading to a Denial of Service (DoS), and may potentially expose sensitive system memory."], "name": "CVE-2026-98612", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98612\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98612\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98612.mbox"], "threat_severity": "Moderate"}