CVE-2026-98025

CVE CVE-2026-98025EUVD EUVD-2026-86678Published 2026-09-25T10:23:43.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow The 0xffff length sentinel detects a router reboot and schedules re-enabling of ethernet mode, but then falls through to the rest of the loop body. The next check is } else if (len > CX82310_MTU) { which is the else of the just-matched if -- it never fires for len == 0xffff. The MTU bound that normally caps the incomplete-packet save path is silently bypassed. With 0xffff > skb->len always true (rx_urb_size is 4096), the incomplete-packet branch saves dev->partial_len = skb->len bytes into dev->partial_data. partial_data is kmalloc(hard_mtu) = kmalloc(CX82310_MTU + 2) = 1516 bytes, but skb->len after the 2-byte header pull can be up to 4094. A device that sends a 4096-byte URB starting with [0xff 0xff] therefore copies 4094 device-provided bytes into a buffer allocated for 1516 bytes, exceeding its requested size by 2578 bytes. The next URB then reads dev->partial_len (4094) back from the same 1516-byte buffer and dev->partial_rem (65535 - 4094 = 61441) from the new URB's ~4KB skb, both well past their allocations, and delivers the spliced result as a 64KB "frame" to the network stack. Bail out of rx_fixup after scheduling the re-enable work; the remainder of a reboot-marker URB is not meaningful packet data. This restores the invariant that partial_len < CX82310_MTU + 2 on the save path, since every other route there has already passed the MTU check.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 <3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287; patch: 0; 5.10; 5.4.284 <5.5; patch: 6.12.111; ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 <659654654eb140851467af41d610473c100c7975; patch: 7.3-rc3; 4.19.322 <4.20; ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 <5d50e90add8b4a978395e893e81954d19d58a7c5; ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 <237c9ae7145772af147e4665f158938350fa5658; patch: 7.2.7; 5adf7fbdfa3e9e425b04771e1d64c4e184ad8fdb; patch: 6.18.53; c1b187a86a176e42f5e48066556980e3232b6cab

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.