CVE-2026-68366

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer

uvc_send_response() builds the UVC control response from a user-supplied

struct uvc_request_data:

req->length = min_t(unsigned int, uvc->event_length, data->length);

...

memcpy(req->buf, data->data, req->length);

req->length is clamped to uvc->event_length, which is taken from the

host control request wLength (up to UVC_MAX_REQUEST_SIZE, 64), and to

data->length, which comes from the UVCIOC_SEND_RESPONSE ioctl and is

only checked for being negative. The source buffer data->data is only

60 bytes, so a response with uvc->event_length and data->length both

greater than 60 makes memcpy() read past the end of data->data.

Clamp req->length to sizeof(data->data) as well.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References