CVE-2026-98597
Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.18 %mayor que el 7 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
net: usb: sr9700: incluir la sobrecarga de recepción en la comprobación de longitud
La corrección de recepción resta el CRC de Ethernet de la longitud del paquete notificada, pero compara esa longitud de carga útil con todo el búfer de recepción restante. La copia posterior comienza después de la cabecera de tres bytes, y el avance del cursor consume tanto dicha cabecera como el CRC de cuatro bytes.
Exige que la carga útil quepa después de SR_RX_OVERHEAD antes de copiarla o de avanzar al siguiente paquete. El bucle ya garantiza que el búfer restante es mayor que la sobrecarga, por lo que la resta es segura.
Leer descripción completaMostrar menos
El fallo fue detectado por nuestra herramienta de análisis estático.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.18 %
- Percentil entre todas las CVEs puntuadas
- 7
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/05b442709bd5256c6c0e11fe56b9a0cb2455c245
- https://git.kernel.org/stable/c/6ab6c9d120b30c94579192ef83a581a3dda6d79c
- https://git.kernel.org/stable/c/8488779d9bddbdb33588c9fc2c0657a3da773f61
- https://git.kernel.org/stable/c/92d88c88390fc62444c00a1a22078f838e03891f
- https://git.kernel.org/stable/c/9b59b00890c5dea355b4cc8795ab8eeafc044e48
- https://git.kernel.org/stable/c/baf07d5153d3af8f98e65e2d3566bc0d50c4e3ac
- https://git.kernel.org/stable/c/c06bde80ae7a7b595732f7cabcb92cf08db9d56a
- https://git.kernel.org/stable/c/e1f5b74edccf4c9b671b6bce4435a98746fe5167
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98597",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
"lessThan": "92d88c88390fc62444c00a1a22078f838e03891f",
"versionType": "git"
},
{
"status": "affected",
"version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
"lessThan": "baf07d5153d3af8f98e65e2d3566bc0d50c4e3ac",
"versionType": "git"
},
{
"status": "affected",
"version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
"lessThan": "8488779d9bddbdb33588c9fc2c0657a3da773f61",
"versionType": "git"
},
{
"status": "affected",
"version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
"lessThan": "e1f5b74edccf4c9b671b6bce4435a98746fe5167",
"versionType": "git"
},
{
"status": "affected",
"version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
"lessThan": "9b59b00890c5dea355b4cc8795ab8eeafc044e48",
"versionType": "git"
},
{
"status": "affected",
"version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
"lessThan": "6ab6c9d120b30c94579192ef83a581a3dda6d79c",
"versionType": "git"
},
{
"status": "affected",
"version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
"lessThan": "05b442709bd5256c6c0e11fe56b9a0cb2455c245",
"versionType": "git"
},
{
"status": "affected",
"version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
"lessThan": "c06bde80ae7a7b595732f7cabcb92cf08db9d56a",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/usb/sr9700.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/usb/sr9700.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:12.387",
"references": [
{
"url": "https://git.kernel.org/stable/c/05b442709bd5256c6c0e11fe56b9a0cb2455c245",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6ab6c9d120b30c94579192ef83a581a3dda6d79c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8488779d9bddbdb33588c9fc2c0657a3da773f61",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/92d88c88390fc62444c00a1a22078f838e03891f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9b59b00890c5dea355b4cc8795ab8eeafc044e48",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/baf07d5153d3af8f98e65e2d3566bc0d50c4e3ac",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c06bde80ae7a7b595732f7cabcb92cf08db9d56a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e1f5b74edccf4c9b671b6bce4435a98746fe5167",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: sr9700: include receive overhead in the length check\n\nThe receive fixup subtracts the Ethernet CRC from the reported packet\nlength, but compares that payload length against the whole remaining\nreceive buffer. The following copy starts after the three-byte header,\nand the cursor advance consumes both that header and the four-byte CRC.\n\nRequire the payload to fit after SR_RX_OVERHEAD before copying it or\nadvancing to the next packet. The loop already ensures that the\nremaining buffer is larger than the overhead, so the subtraction is\nsafe.\n\nThe issue was found by our static-analysis tool."
}
],
"lastModified": "2026-10-19T10:19:21.057",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}