CVE-2026-64339 - Vulnerability Details

- usb: misc: usbio: bound bulk IN response length to the received transfer

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: misc: usbio: bound bulk IN response length to the received transfer

usbio_bulk_msg() copies bpkt_len = le16_to_cpu(bpkt->len) bytes out of
the bulk IN buffer (usbio->rxbuf, allocated with size usbio->rxbuf_len)
into the caller's buffer. bpkt_len is fully controlled by the device
and is only checked against ibuf_len; ibuf_len in turn is checked
against usbio->txbuf_len, not against rxbuf_len:

if ((obuf_len > (usbio->txbuf_len - sizeof(*bpkt))) ||
(ibuf_len > (usbio->txbuf_len - sizeof(*bpkt))))
return -EMSGSIZE;

txbuf_len and rxbuf_len are taken independently from the bulk OUT and
bulk IN endpoint wMaxPacketSize in usbio_probe(). A malicious or
malfunctioning device that advertises a large bulk OUT endpoint and a
small bulk IN endpoint (e.g. by claiming one of the quirk-free IDs such
as the Lattice NX33U, 0x2ac1:0x20cb) therefore makes ibuf_len, and
hence the device-supplied bpkt_len, exceed rxbuf_len. memcpy() then
reads up to txbuf_len - rxbuf_len bytes past the end of the rxbuf slab
object. The over-read bytes are handed back to the i2c layer and on to
user space through i2c-dev, disclosing adjacent slab memory; with KASAN
this is reported as a slab-out-of-bounds read.

The number of bytes actually received is already known: act equals the
URB actual_length and is bounded by rxbuf_len. Reject any response
that claims more payload than was received, mirroring the existing
"act < sizeof(*bpkt)" check just above.

The control path (usbio_ctrl_msg()) is not affected: it uses a single
buffer (ctrlbuf) for both directions, so its analogous copy can never
leave the allocation.

Found by code review. The out-of-bounds read was confirmed under
AddressSanitizer with a faithful userspace model of usbio_bulk_msg()'s
receive path (an rxbuf_len-sized buffer, the same act/ibuf_len/bpkt_len
checks and the memcpy). A USB raw-gadget + dummy_hcd reproducer is
also available.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel usbio driver contains an out‑of‑bounds read in its bulk IN message handling routine. A malicious USB device that advertises a large bulk OUT endpoint and a small bulk IN endpoint can supply a packet length that exceeds the allocated receive buffer. The driver copies this oversized length into the user‑supplied buffer, causing the kernel to read beyond the end of the rxbuf slab. The over‑read is returned to user space via the i2c‑dev interface, exposing adjacent kernel memory. The flaw is an out‑of‑bounds read (CWE‑125) and can disclose sensitive data but does not provide remote code execution or privilege escalation.

Affected Systems

The flaw exists in the generic usbio subsystem of the Linux kernel and is independent of distribution. Any system running a kernel version that has not incorporated the fix that binds the bulk IN response length to the received transfer is vulnerable. The commit that resolves the issue is referenced in the kernel commits provided, so kernels older than that revision should be upgraded to a patched release.

Risk and Exploitability

The EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low probability of exploitation. The CVSS score of 5.5 indicates moderate severity. An attacker would need physical or compromised USB access with a device that advertises incompatible bulk endpoint sizes. The impact is limited to information disclosure through the i2c‑dev interface; no privilege escalation or remote execution is described.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`121a0f839dbb397af5fabb701cea3e9983223e50`	affected	< 48394f94211cf8fe0ea8604fc441633abf90fc94
`121a0f839dbb397af5fabb701cea3e9983223e50`	affected	< fc1b546973c1442d5b947fcdd03581f20ecc5bd2
`121a0f839dbb397af5fabb701cea3e9983223e50`	affected	< 8c6314489550fa81d41723a0ff33f655b5b6c7b6

Linux

affected

Version	Status	Constraints
`6.18`	affected	—
`0`	unaffected	< 6.18
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[121a0f839dbb397af5fabb701cea3e9983223e50,48394f94211cf8fe0ea8604fc441633abf90fc94)`	affected	code_commit	—
`[121a0f839dbb397af5fabb701cea3e9983223e50,fc1b546973c1442d5b947fcdd03581f20ecc5bd2)`	affected	code_commit	—
`[121a0f839dbb397af5fabb701cea3e9983223e50,8c6314489550fa81d41723a0ff33f655b5b6c7b6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.18`	affected	generic	—
`[0,6.18)`	unaffected	generic	—
`[6.18.39,7.0.0)`	unaffected	semver	—
`[7.1.4,8.0.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the usbio bulk IN length bound fix
If an immediate update is not possible, disable the usbio driver or block raw USB device enumeration through udev rules or kernel parameters
Apply a USB device whitelist or blacklist to allow only approved devices and reject those advertising conflicting bulk endpoint sizes

Generated by OpenCVE AI on August 5, 2026 at 00:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00198.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/48394f94211cf8fe0ea8604fc441633abf90fc94
https://git.kernel.org/stable/c/8c6314489550fa81d41723a0ff33f655b5b6c7b6
https://git.kernel.org/stable/c/fc1b546973c1442d5b947fcdd03581f20ecc5bd2
https://lore.kernel.org/linux-cve-announce/2026072515-CVE-2026-64339-cb0c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64339
https://www.cve.org/CVERecord?id=CVE-2026-64339

History

Mon, 03 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072515-CVE-2026-64339-cb0c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64339 https://www.cve.org/CVERecord?id=CVE-2026-64339
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 02 Aug 2026 13:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Sat, 01 Aug 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Mon, 27 Jul 2026 06:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbio_bulk_msg() copies bpkt_len = le16_to_cpu(bpkt->len) bytes out of the bulk IN buffer (usbio->rxbuf, allocated with size usbio->rxbuf_len) into the caller's buffer. bpkt_len is fully controlled by the device and is only checked against ibuf_len; ibuf_len in turn is checked against usbio->txbuf_len, not against rxbuf_len: if ((obuf_len > (usbio->txbuf_len - sizeof(bpkt))) \|\| (ibuf_len > (usbio->txbuf_len - sizeof(bpkt)))) return -EMSGSIZE; txbuf_len and rxbuf_len are taken independently from the bulk OUT and bulk IN endpoint wMaxPacketSize in usbio_probe(). A malicious or malfunctioning device that advertises a large bulk OUT endpoint and a small bulk IN endpoint (e.g. by claiming one of the quirk-free IDs such as the Lattice NX33U, 0x2ac1:0x20cb) therefore makes ibuf_len, and hence the device-supplied bpkt_len, exceed rxbuf_len. memcpy() then reads up to txbuf_len - rxbuf_len bytes past the end of the rxbuf slab object. The over-read bytes are handed back to the i2c layer and on to user space through i2c-dev, disclosing adjacent slab memory; with KASAN this is reported as a slab-out-of-bounds read. The number of bytes actually received is already known: act equals the URB actual_length and is bounded by rxbuf_len. Reject any response that claims more payload than was received, mirroring the existing "act < sizeof(*bpkt)" check just above. The control path (usbio_ctrl_msg()) is not affected: it uses a single buffer (ctrlbuf) for both directions, so its analogous copy can never leave the allocation. Found by code review. The out-of-bounds read was confirmed under AddressSanitizer with a faithful userspace model of usbio_bulk_msg()'s receive path (an rxbuf_len-sized buffer, the same act/ibuf_len/bpkt_len checks and the memcpy). A USB raw-gadget + dummy_hcd reproducer is also available.
Title		usb: misc: usbio: bound bulk IN response length to the received transfer
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/48394f94211cf8fe0ea8604fc441633abf90fc94 https://git.kernel.org/stable/c/8c6314489550fa81d41723a0ff33f655b5b6c7b6 https://git.kernel.org/stable/c/fc1b546973c1442d5b947fcdd03581f20ecc5bd2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:03.272Z

Updated: 2026-07-25T08:50:03.272Z

Reserved: 2026-07-19T15:36:31.781Z

Link: CVE-2026-64339

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:15.870

Modified: 2026-08-11T15:00:57.447

Link: CVE-2026-64339

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64339 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-05T01:00:07Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object