Description
In the Linux kernel, the following vulnerability has been resolved:
usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT endpoint size. Both are taken independently from different endpoints in usbio_probe(), so the check is wrong when they differ.
Use rxbuf_len for the IN direction. This matches the buffer that actually holds the response data.
Metrics
No CVSS score has been published yet.
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 121a0f839dbb397af5fabb701cea3e9983223e50, < ebfd1e82ab0a6d26efd9bdd89de899215851f5bf; >= 121a0f839dbb397af5fabb701cea3e9983223e50, < 9ad0164f78b66b0b5eca3a5748cc94dd87e28124; >= 121a0f839dbb397af5fabb701cea3e9983223e50, < 7e22c9f79b200672f3e477421b6c9050d8cf70a5 |
| Linux | Linux | 6.18 |
References
Timeline
- Published
- Aug 22, 2026
- Last modified
- Oct 14, 2026
- NVD status
- Received