CVE-2026-98612
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
net: usb: catc: acotar la longitud de los paquetes RX en catc_rx_done()
catc_rx_done() recorre una URB con varios paquetes y lee una longitud de dos bytes de la cabecera de cada paquete. Su límite, pkt_len > urb->actual_length, ignora el desplazamiento de la cabecera y compara contra la transferencia completa en lugar de contra los bytes que quedan desde pkt_start, de modo que una cabecera de paquete manipulada hace que skb_copy_to_linear_data() lea más allá del búfer.
También se acepta una longitud inferior a ETH_HLEN, incluida la de cero, y entonces eth_type_trans() lee una cabecera MAC del espacio de cola sin inicializar de un skb más corto.
Leer descripción completaMostrar menos
La rama is_f5u011 toma su longitud directamente de la transferencia, por lo que una URB de longitud cero llega a la misma ruta.
Se lleva el registro de los bytes restantes del paquete actual, y se rechaza una cabecera que no cabe, una longitud que supera lo que queda y una longitud inferior a una cabecera Ethernet.
Una transferencia más corta que una cabecera Ethernet, incluida una de longitud cero, se convertía antes en un skb demasiado pequeño que se pasaba a netif_rx() y se contaba como recibido; ahora se contabiliza en rx_length_errors y termina el recorrido.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.19 %
- Percentil entre todas las CVEs puntuadas
- 8
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/21e206dd88b3de6e36bb607dec3797c59bc3007b
- https://git.kernel.org/stable/c/2f87bbd5a7bf6ee79d598f7e22cf77810d29ae87
- https://git.kernel.org/stable/c/3942557938f846e7481f6ccb2b41ccbdee61baa1
- https://git.kernel.org/stable/c/4cc0a8eb2f9336cfa3e4ac329bc5585ca970ced3
- https://git.kernel.org/stable/c/801e21cf7dd6bcee31db907625d5045f21c9c1d9
- https://git.kernel.org/stable/c/9d4be026bdff2c1da7b6c7e01c0a47f2df409e97
- https://git.kernel.org/stable/c/9d565b6b72fe3f41fd43636e143072848105189f
- https://git.kernel.org/stable/c/dd9c6f8f05170223edec2dac476606cd40d9acb7
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98612",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "3942557938f846e7481f6ccb2b41ccbdee61baa1",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "2f87bbd5a7bf6ee79d598f7e22cf77810d29ae87",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "4cc0a8eb2f9336cfa3e4ac329bc5585ca970ced3",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "21e206dd88b3de6e36bb607dec3797c59bc3007b",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "801e21cf7dd6bcee31db907625d5045f21c9c1d9",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "dd9c6f8f05170223edec2dac476606cd40d9acb7",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "9d4be026bdff2c1da7b6c7e01c0a47f2df409e97",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "9d565b6b72fe3f41fd43636e143072848105189f",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/usb/catc.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/usb/catc.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:14.030",
"references": [
{
"url": "https://git.kernel.org/stable/c/21e206dd88b3de6e36bb607dec3797c59bc3007b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2f87bbd5a7bf6ee79d598f7e22cf77810d29ae87",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3942557938f846e7481f6ccb2b41ccbdee61baa1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4cc0a8eb2f9336cfa3e4ac329bc5585ca970ced3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/801e21cf7dd6bcee31db907625d5045f21c9c1d9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9d4be026bdff2c1da7b6c7e01c0a47f2df409e97",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9d565b6b72fe3f41fd43636e143072848105189f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dd9c6f8f05170223edec2dac476606cd40d9acb7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: catc: bound the RX packet length in catc_rx_done()\n\ncatc_rx_done() walks a multi-packet URB, reading a two-byte length from\neach packet header. Its bound, pkt_len > urb->actual_length, ignores the\nheader offset and compares against the whole transfer rather than the\nbytes left from pkt_start, so a crafted packet header makes\nskb_copy_to_linear_data() read past the buffer.\n\nA length below ETH_HLEN is also accepted, including zero, and\neth_type_trans() then reads a MAC header from the uninitialised tailroom\nof a shorter skb. The is_f5u011 branch takes its length straight from\nthe transfer, so a zero-length URB reaches the same path.\n\nTrack the bytes remaining from the current packet, and reject a header\nthat does not fit, a length past what is left, and a length below an\nEthernet header.\n\nA transfer shorter than an Ethernet header, including a zero-length one,\npreviously became a runt skb passed to netif_rx() and counted as\nreceived; it is now counted in rx_length_errors and ends the walk."
}
],
"lastModified": "2026-10-19T10:19:23.413",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}