CVE-2026-98025 - Vulnerability Details

- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow

Description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow

The 0xffff length sentinel detects a router reboot and schedules
re-enabling of ethernet mode, but then falls through to the rest
of the loop body. The next check is

} else if (len > CX82310_MTU) {

which is the else of the just-matched if -- it never fires for
len == 0xffff. The MTU bound that normally caps the
incomplete-packet save path is silently bypassed.

With 0xffff > skb->len always true (rx_urb_size is 4096), the
incomplete-packet branch saves dev->partial_len = skb->len bytes
into dev->partial_data. partial_data is kmalloc(hard_mtu) =
kmalloc(CX82310_MTU + 2) = 1516 bytes, but skb->len after the
2-byte header pull can be up to 4094. A device that sends a
4096-byte URB starting with [0xff 0xff] therefore copies 4094
device-provided bytes into a buffer allocated for 1516 bytes,
exceeding its requested size by 2578 bytes.

The next URB then reads dev->partial_len (4094) back from the same
1516-byte buffer and dev->partial_rem (65535 - 4094 = 61441) from
the new URB's ~4KB skb, both well past their allocations, and
delivers the spliced result as a 64KB "frame" to the network
stack.

Bail out of rx_fixup after scheduling the re-enable work; the
remainder of a reboot-marker URB is not meaningful packet data.
This restores the invariant that partial_len < CX82310_MTU + 2 on
the save path, since every other route there has already passed
the MTU check.

Published: 2026-09-25

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A malformed 4096‑byte URB sent to a USB Ethernet adapter using the cx82310_eth driver triggers a loop that copies the 4094 bytes of data into a 1516‑byte kernel buffer. This bypasses the MTU check and results in a heap buffer overflow, corrupting kernel memory and producing an oversized 64‑KB packet that is injected into the network stack. The flaw arises from improper bounds validation and leads to loss of data integrity and confidentiality within the kernel.

Affected Systems

All Linux kernel releases that include the cx82310_eth driver and have not applied the patch referenced in the provided git commits. The issue resides in source files under drivers/net/usb and affects any distribution using those kernel versions until the security fixes are merged.

Risk and Exploitability

The CVSS score of 7.0 classifies this vulnerability as high severity. The EPSS score is less than 1%, indicating that exploitation attempts are currently rare, and it is not listed in the CISA KEV catalog, meaning no confirmed exploits are known. The exploitation surface requires an attacker to deliver a crafted USB packet to a host that enumerates the cx82310_eth device. Successful exploitation would allow an attacker to corrupt kernel memory, potentially leading to privilege escalation, denial of service, or arbitrary code execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808`	affected	< d0c1ce6ef4cefe568e19afa83f543caa3c3c0873
`ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808`	affected	< 0dbc89e664b4609ad672b5bdeef60df251294b8f
`ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808`	affected	< 00520cdd21ea6a9b5dc8d53bbd241620d2059554
`ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808`	affected	< 59bf9e94bdc49557f07d87164269daff7340f4d6
`ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808`	affected	< 3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287
`ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808`	affected	< 659654654eb140851467af41d610473c100c7975
`ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808`	affected	< 237c9ae7145772af147e4665f158938350fa5658
`ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808`	affected	< 5d50e90add8b4a978395e893e81954d19d58a7c5
`5adf7fbdfa3e9e425b04771e1d64c4e184ad8fdb`	affected	—
`c1b187a86a176e42f5e48066556980e3232b6cab`	affected	—
`4.19.322`	affected	< 4.20
`5.4.284`	affected	< 5.5

Linux

affected

Version	Status	Constraints
`5.10`	affected	—
`0`	unaffected	< 5.10
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808,3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287)`	affected	code_commit	—
`[ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808,659654654eb140851467af41d610473c100c7975)`	affected	code_commit	—
`[ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808,237c9ae7145772af147e4665f158938350fa5658)`	affected	code_commit	—
`[ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808,5d50e90add8b4a978395e893e81954d19d58a7c5)`	affected	code_commit	—
`5adf7fbdfa3e9e425b04771e1d64c4e184ad8fdb`	affected	code_commit	—
`c1b187a86a176e42f5e48066556980e3232b6cab`	affected	code_commit	—
`[4.19.322,4.20)`	affected	semver	—
`[5.4.284,5.5)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.10`	affected	generic	—
`[0,5.10)`	unaffected	generic	—
`[6.12.111,6.13.0]`	unaffected	semver	—
`[6.18.53,6.19.0]`	unaffected	semver	—
`[7.2.7,7.3.0]`	unaffected	semver	—
`[7.3-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the running Linux kernel to the latest stable version that includes the patch found in the referenced commits (for example, the changes in commit 5d50e90add8b4a978395e893e81954d19d58a7c5).
If an update cannot be applied immediately, unload or disable the cx82310_eth driver and block USB devices that use the affected hardware from connecting to the system.
Continuously monitor network interfaces for anomalous packet sizes, particularly unexpected 64‑KB frames, which may indicate an attempted exploitation.

Generated by OpenCVE AI on September 30, 2026 at 14:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00237.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98025.mbox
https://git.kernel.org/stable/c/00520cdd21ea6a9b5dc8d53bbd241620d2059554
https://git.kernel.org/stable/c/0dbc89e664b4609ad672b5bdeef60df251294b8f
https://git.kernel.org/stable/c/237c9ae7145772af147e4665f158938350fa5658
https://git.kernel.org/stable/c/3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287
https://git.kernel.org/stable/c/59bf9e94bdc49557f07d87164269daff7340f4d6
https://git.kernel.org/stable/c/5d50e90add8b4a978395e893e81954d19d58a7c5
https://git.kernel.org/stable/c/659654654eb140851467af41d610473c100c7975
https://git.kernel.org/stable/c/d0c1ce6ef4cefe568e19afa83f543caa3c3c0873
https://nvd.nist.gov/vuln/detail/CVE-2026-98025
https://www.cve.org/CVERecord?id=CVE-2026-98025

History

Sat, 03 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/00520cdd21ea6a9b5dc8d53bbd241620d2059554 https://git.kernel.org/stable/c/0dbc89e664b4609ad672b5bdeef60df251294b8f https://git.kernel.org/stable/c/59bf9e94bdc49557f07d87164269daff7340f4d6 https://git.kernel.org/stable/c/d0c1ce6ef4cefe568e19afa83f543caa3c3c0873

Tue, 29 Sep 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-122

Tue, 29 Sep 2026 13:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98025.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98025 https://www.cve.org/CVERecord?id=CVE-2026-98025
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 25 Sep 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-122

Fri, 25 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow The 0xffff length sentinel detects a router reboot and schedules re-enabling of ethernet mode, but then falls through to the rest of the loop body. The next check is } else if (len > CX82310_MTU) { which is the else of the just-matched if -- it never fires for len == 0xffff. The MTU bound that normally caps the incomplete-packet save path is silently bypassed. With 0xffff > skb->len always true (rx_urb_size is 4096), the incomplete-packet branch saves dev->partial_len = skb->len bytes into dev->partial_data. partial_data is kmalloc(hard_mtu) = kmalloc(CX82310_MTU + 2) = 1516 bytes, but skb->len after the 2-byte header pull can be up to 4094. A device that sends a 4096-byte URB starting with [0xff 0xff] therefore copies 4094 device-provided bytes into a buffer allocated for 1516 bytes, exceeding its requested size by 2578 bytes. The next URB then reads dev->partial_len (4094) back from the same 1516-byte buffer and dev->partial_rem (65535 - 4094 = 61441) from the new URB's ~4KB skb, both well past their allocations, and delivers the spliced result as a 64KB "frame" to the network stack. Bail out of rx_fixup after scheduling the re-enable work; the remainder of a reboot-marker URB is not meaningful packet data. This restores the invariant that partial_len < CX82310_MTU + 2 on the save path, since every other route there has already passed the MTU check.
Title		net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/237c9ae7145772af147e4665f158938350fa5658 https://git.kernel.org/stable/c/3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287 https://git.kernel.org/stable/c/5d50e90add8b4a978395e893e81954d19d58a7c5 https://git.kernel.org/stable/c/659654654eb140851467af41d610473c100c7975

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:23:43.906Z

Updated: 2026-10-19T09:12:30.354Z

Reserved: 2026-09-25T10:19:56.070Z

Link: CVE-2026-98025

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:31.110

Modified: 2026-10-19T10:17:56.440

Link: CVE-2026-98025

Redhat

Severity : Moderate

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-98025 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-30T14:15:16Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object