CVE-2026-64339

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

usb: misc: usbio: bound bulk IN response length to the received transfer

usbio_bulk_msg() copies bpkt_len = le16_to_cpu(bpkt->len) bytes out of

the bulk IN buffer (usbio->rxbuf, allocated with size usbio->rxbuf_len)

into the caller's buffer. bpkt_len is fully controlled by the device

and is only checked against ibuf_len; ibuf_len in turn is checked

against usbio->txbuf_len, not against rxbuf_len:

if ((obuf_len > (usbio->txbuf_len - sizeof(*bpkt))) ||

(ibuf_len > (usbio->txbuf_len - sizeof(*bpkt))))

return -EMSGSIZE;

txbuf_len and rxbuf_len are taken independently from the bulk OUT and

bulk IN endpoint wMaxPacketSize in usbio_probe(). A malicious or

malfunctioning device that advertises a large bulk OUT endpoint and a

small bulk IN endpoint (e.g. by claiming one of the quirk-free IDs such

as the Lattice NX33U, 0x2ac1:0x20cb) therefore makes ibuf_len, and

hence the device-supplied bpkt_len, exceed rxbuf_len

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References