The Linux kernel’s catc USB driver contains a flaw in the catc_rx_done function, where a two‑byte length field is read from each packet header without proper bounds checking. The check incorrectly compares the length against the entire URB length instead of the remaining bytes, allowing a crafted packet to cause skb_copy_to_linear_data to read past the buffer’s end. Packet lengths below the Ethernet header size, including zero, are also accepted, which can result in reads from uninitialised memory and the creation of a malformed network packet that may trigger a kernel crash or other undefined behaviour.

All Linux kernel releases that include the unpatched catc driver are affected. No specific kernel version numbers are listed; the patch referenced by commit 21e206d indicates the issue existed prior to that commit.

The CVE does not have an EPSS score and is not listed in the CISA KEV catalog, suggesting no publicly known exploits. Exploitation would require an attacker-controlled USB device employing the catc interface to be connected to a host running the vulnerable kernel, and the attacker would need to send malformed packets to trigger the out‑of‑bounds read. The impact is local and leads to denial of service for the host, potentially causing a crash and loss of network services. Because the attack vector is tied to a physical USB interface and no remote control is demonstrated, the likelihood of exploitation remains low to moderate for systems with strict USB device controls.