CVE-2026-68369

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: printer: fix infinite loop in printer_read()

printer_read() uses the same variable for the requested copy size and

the number of bytes actually copied to user space. copy_to_user()

returns the number of bytes not copied, so when it fails to copy

anything, the computed copied length becomes zero.

In that case len, buf, current_rx_bytes and current_rx_buf are left

unchanged. If RX data is available and the user buffer remains

unwritable, the read loop can repeat indefinitely.

Track the copied length separately and return -EFAULT, or the number of

bytes already copied, if an iteration makes no progress.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References