The catc USB driver in the Linux kernel reads packet lengths from packet headers without correct bounds checking. This allows an attacker to supply a specially crafted packet that causes skb_copy_to_linear_data to read beyond the end of the buffer, leading to a kernel out-of-bounds read (CWE-125) and potential crash. The driver also accepts lengths below the Ethernet header size, including zero, which can result in uninitialized memory reads and malformed network packets. Because the function propagates these errors to the networking stack, the host can experience kernel panics or service interruptions.

Linux kernel builds that include the unpatched catc driver are affected. Vendor and product are Linux:Linux. No specific kernel version is listed, but the reference commit 21e206d shows the fix applied after the vulnerability existed, so any kernel version prior to that commit may be vulnerable.

The CVSS score of 6.8 indicates moderate severity. The EPSS score of less than 1% implies a very low exploitation probability, and the vulnerability is not present in the CISA KEV catalog. The likely attack vector is a physical or otherwise trusted USB device that uses the catc interface; an attacker would need to connect a crafted USB endpoint to a host running a vulnerable kernel. Under those conditions, a malformed packet can trigger an out-of-bounds read, cause a kernel panic, and result in denial of service of the affected host. Because the vector requires proximity and device control, the overall risk for hardened systems remains low to moderate.