CVE-2026-74681

Not scored yetLast modified Oct 14, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg

ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT endpoint size. Both are taken independently from different endpoints in usbio_probe(), so the check is wrong when they differ.

Use rxbuf_len for the IN direction. This matches the buffer that actually holds the response data.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 22, 2026
Last modified
Oct 14, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-74682In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs data_ep_set_parCVE-2026-74683In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks TheCVE-2026-746847.1In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb->dev before parsing virtio net header in tap_get_userCVE-2026-74685In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc4282) Clamp negative current limits When a negative value iCVE-2026-74686In the Linux kernel, the following vulnerability has been resolved: rqspinlock: Reset tail when preserving queue on deadlock Currently, thCVE-2026-746877.8In the Linux kernel, the following vulnerability has been resolved: watchdog: at91sam9_wdt: prevent timer rearm during teardown at91_ping(CVE-2026-746889.8In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp_make_hCVE-2026-746897.1In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() vcc_setsockopCVE-2026-74696.3A vulnerability was detected in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. This impacts the function sub_425A28 of the file /goform/DelFiCVE-2026-746908.4In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ism_dev_exit() A ism interruptCVE-2026-746918.8In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Tear down DMA paths before stopping the rings tbnet_CVE-2026-746927.5In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smc_listen_out() and listener close s
CVE-2026-74681: Unscored | Vulnix