All vulnerabilities
CVE-2026-98025

Linux: net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0dbc89e664b4609ad672b5bdeef60df251294b8fAlso 00520cdd21ea6a9b5dc8d53bbd241620d2059554, 59bf9e94bdc49557f07d87164269daff7340f4d6 and 6 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 0dbc89e664b4609ad672b5bdeef60df251294b8fLinuxCVE List
  • 00520cdd21ea6a9b5dc8d53bbd241620d2059554LinuxCVE List
  • 59bf9e94bdc49557f07d87164269daff7340f4d6LinuxCVE List
  • 3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287LinuxCVE List
  • 659654654eb140851467af41d610473c100c7975LinuxCVE List
  • 237c9ae7145772af147e4665f158938350fa5658LinuxCVE List
Show all 9 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow

The 0xffff length sentinel detects a router reboot and schedules re-enabling of ethernet mode, but then falls through to the rest of the loop body. The next check is

} else if (len > CX82310_MTU) {

which is the else of the just-matched if -- it never fires for len == 0xffff. The MTU bound that normally caps the incomplete-packet save path is silently bypassed.

With 0xffff > skb->len always true (rx_urb_size is 4096), the incomplete-packet branch saves dev->partial_len = skb->len bytes into dev->partial_data. partial_data is kmalloc(hard_mtu) = kmalloc(CX82310_MTU + 2) = 1516 bytes, but skb->len after the 2-byte header pull can be up to 4094. A device that sends a 4096-byte URB starting with [0xff 0xff] therefore copies 4094 device-provided bytes into a buffer allocated for 1516 bytes, exceeding its requested size by 2578 bytes.

The next URB then reads dev->partial_len (4094) back from the same 1516-byte buffer and dev->partial_rem (65535 - 4094 = 61441) from the new URB's ~4KB skb, both well past their allocations, and delivers the spliced result as a 64KB "frame" to the network stack.

Bail out of rx_fixup after scheduling the re-enable work; the remainder of a reboot-marker URB is not meaningful packet data. This restores the invariant that partial_len < CX82310_MTU + 2 on the save path, since every other route there has already passed the MTU check.

Text from CVE List

Affected versions 22

  • Linuxaffected: ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before d0c1ce6ef4cefe568e19afa83f543caa3c3c0873CVE List
  • Linuxaffected: ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before 0dbc89e664b4609ad672b5bdeef60df251294b8fCVE List
  • Linuxaffected: ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before 00520cdd21ea6a9b5dc8d53bbd241620d2059554CVE List
  • Linuxaffected: ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before 59bf9e94bdc49557f07d87164269daff7340f4d6CVE List
  • Linuxaffected: ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before 3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287CVE List
  • Linuxaffected: ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before 659654654eb140851467af41d610473c100c7975CVE List
  • Linuxaffected: ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before 237c9ae7145772af147e4665f158938350fa5658CVE List
  • Linuxaffected: ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808 before 5d50e90add8b4a978395e893e81954d19d58a7c5CVE List
  • Linuxaffected: 5adf7fbdfa3e9e425b04771e1d64c4e184ad8fdbCVE List
  • Linuxaffected: c1b187a86a176e42f5e48066556980e3232b6cabCVE List
  • Linuxaffected: 4.19.322 before 4.20CVE List
  • Linuxaffected: 5.4.284 before 5.5CVE List
  • Linuxaffected: 5.10CVE List
  • Linuxunaffected: all versions before 5.10CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8