{"id":"CVE-2026-98612","kind":"vulnerability","aliases":["CVE-2026-98612"],"related":[],"title":"Linux kernel: USB catc driver reads past receive buffer on crafted packets","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: catc: bound the RX packet length in catc_rx_done()\n\ncatc_rx_done() walks a multi-packet URB, reading a two-byte length from\neach packet header. Its bound, pkt_len > urb->actual_length, ignores the\nheader offset and compares against the whole transfer rather than the\nbytes left from pkt_start, so a crafted packet header makes\nskb_copy_to_linear_data() read past the buffer.\n\nA length below ETH_HLEN is also accepted, including zero, and\neth_type_trans() then reads a MAC header from the uninitialised tailroom\nof a shorter skb. The is_f5u011 branch takes its length straight from\nthe transfer, so a zero-length URB reaches the same path.\n\nTrack the bytes remaining from the current packet, and reject a header\nthat does not fit, a length past what is left, and a length below an\nEthernet header.\n\nA transfer shorter than an Ethernet header, including a zero-length one,\npreviously became a runt skb passed to netif_rx() and counted as\nreceived; it is now counted in rx_length_errors and ends the walk.","summary":"A crafted USB packet header makes the Linux kernel's catc network driver copy data past the end of its receive buffer, and accepts undersized frames that lead to reads of uninitialised memory. The sources do not state whether this allows code execution or only crashes and information leaks.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["catc","kernel","linux","runtime","usb"],"not_affected_if":["default-config","no-catc-driver"],"how_to_check":"- Check whether the `catc` driver is loaded with `lsmod | grep catc` or built in with `grep CONFIG_USB_NET_CDCETHER /boot/config-$(uname -r)` (the catc driver is `CONFIG_USB_CATC`)\n- Compare the running kernel with `uname -r` against the fixed kernel release listed in the upstream stable tree (unknown in the sources)","fix":"- Update the Linux kernel to a release that includes the upstream commit 'net: usb: catc: bound the RX packet length in catc_rx_done()' (version unknown in the sources)\n- Blacklist the catc module if USB CATC adapters are not used: `echo 'blacklist catc' > /etc/modprobe.d/catc.conf`","status":"open","published_at":"2026-10-18T16:17:14+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:24+00:00","updated_at":"2026-10-25T05:21:24+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:21:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'net: usb: catc: bound the RX packet length in catc_rx_done()' (version unknown in the sources)\n- Blacklist the catc module if USB CATC adapters are not used: `echo 'blacklist catc' > /etc/modprobe.d/catc.conf`","reach":"local","title":"Linux kernel: USB catc driver reads past receive buffer on crafted packets","impact":"medium","summary":"A crafted USB packet header makes the Linux kernel's catc network driver copy data past the end of its receive buffer, and accepts undersized frames that lead to reads of uninitialised memory. The sources do not state whether this allows code execution or only crashes and information leaks.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","usb","catc"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel memory is read or corrupted through crafted USB network packets","analyst_note":"Find the fixed kernel versions and the upstream commit in the NVD entry or kernel.org stable advisories, and confirm whether a malicious USB device alone can trigger the flaw.","how_to_check":"- Check whether the `catc` driver is loaded with `lsmod | grep catc` or built in with `grep CONFIG_USB_NET_CDCETHER /boot/config-$(uname -r)` (the catc driver is `CONFIG_USB_CATC`)\n- Compare the running kernel with `uname -r` against the fixed kernel release listed in the upstream stable tree (unknown in the sources)","needs_analyst":true,"not_affected_if":["default-config","no-catc-driver"],"who_is_affected":"Only systems that load the catc USB network driver, which supports CATC USB-to-Ethernet adapters, are exposed. Machines without these adapters, and kernels built without the driver, can skip it. The sources do not say whether an attacker needs physical access to plug in a device or can trigger this remotely.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000726,"input_tokens":3595,"output_tokens":733,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98612':15A,18A 'accept':47B,161C 'actual':119C 'allow':64B 'also':160C 'becam':245C 'bound':86C,115C 'branch':184C 'buffer':9A,45B,153C 'byte':108C,134C,204C 'catc':4A,19B,34B,85C,92C,95C 'code':65B 'compar':126C 'copi':37B,146C 'count':254C,260C 'craft':11A,25B,141C 'crash':69B 'current':208C 'cve':13A,16A 'data':38B,149C 'done':94C,97C 'driver':5A,36B 'end':41B,266C 'error':264C 'eth':157C,165C 'ethernet':229C,236C 'execut':66B 'f5u011':183C 'fit':217C 'follow':78C 'frame':49B 'header':28B,113C,123C,143C,172C,213C,230C,237C 'hlen':158C 'ignor':121C 'includ':162C,238C 'inform':71B 'kernel':2A,20B,32B,76C 'lead':51B 'leak':72B 'left':135C,223C 'len':117C 'length':90C,109C,120C,155C,187C,196C,219C,226C,242C,263C 'linear':148C 'linux':1A,21B,31B,75C 'mac':171C 'make':29B,144C 'memori':56B 'multi':101C 'multi-packet':100C 'net':83C 'netif':251C 'network':35B 'offset':124C 'one':243C 'packet':12A,27B,89C,102C,112C,142C,209C 'pass':249C 'past':7A,39B,151C,220C 'path':201C 'pkt':116C,137C 'previous':244C 'rather':131C 'reach':198C 'read':6A,53B,104C,150C,169C 'receiv':8A,44B,256C 'reject':211C 'remain':205C 'resolv':82C 'runt':247C 'runtim':22B 'rx':88C,93C,96C,252C,262C 'shorter':179C,233C 'skb':145C,180C,248C 'sourc':58B 'start':138C 'state':61B 'straight':188C 'tailroom':176C 'take':185C 'track':202C 'tran':167C 'transfer':130C,191C,232C 'two':107C 'two-byt':106C 'type':166C 'unders':48B 'uninitialis':55B,175C 'urb':103C,118C,197C 'usb':3A,23B,26B,84C 'vulner':79C 'walk':98C,268C 'whether':62B 'whole':129C 'zero':163C,195C,241C 'zero-length':194C,240C","nicknames":[],"mitigations":[],"who_affected":"Only systems that load the catc USB network driver, which supports CATC USB-to-Ethernet adapters, are exposed. Machines without these adapters, and kernels built without the driver, can skip it. The sources do not say whether an attacker needs physical access to plug in a device or can trigger this remotely.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98612","severity":null,"published_at":"2026-10-18T16:17:14+00:00","modified_at":"2026-10-19T10:19:23+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}