CVE-2026-68369

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68369", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.386Z", "datePublished": "2026-08-10T12:03:46.845Z", "dateUpdated": "2026-08-19T16:34:28.812Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:34:28.812Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: printer: fix infinite loop in printer_read()\n\nprinter_read() uses the same variable for the requested copy size and\nthe number of bytes actually copied to user space. copy_to_user()\nreturns the number of bytes not copied, so when it fails to copy\nanything, the computed copied length becomes zero.\n\nIn that case len, buf, current_rx_bytes and current_rx_buf are left\nunchanged. If RX data is available and the user buffer remains\nunwritable, the read loop can repeat indefinitely.\n\nTrack the copied length separately and return -EFAULT, or the number of\nbytes already copied, if an iteration makes no progress."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/f_printer.c"], "versions": [{"version": "b185f01a9ab7af586133be2555298e960237359b", "lessThan": "3f81197364b57e5318620c75f3bd63f405f60552", "status": "affected", "versionType": "git"}, {"version": "b185f01a9ab7af586133be2555298e960237359b", "lessThan": "e225e2998e5a9b83c838dbbe4511fb0d63f88daf", "status": "affected", "versionType": "git"}, {"version": "b185f01a9ab7af586133be2555298e960237359b", "lessThan": "3081b0e187065c3b9577e393ad664b12854aeaf3", "status": "affected", "versionType": "git"}, {"version": "b185f01a9ab7af586133be2555298e960237359b", "lessThan": "994afccfdcceb73be33f69a8a8ea71e260c9eca5", "status": "affected", "versionType": "git"}, {"version": "b185f01a9ab7af586133be2555298e960237359b", "lessThan": "e03597ad9494b500344076589aeaa6c6d2d381d3", "status": "affected", "versionType": "git"}, {"version": "b185f01a9ab7af586133be2555298e960237359b", "lessThan": "4cde0b38cc0cb8b7dc17295801015148de37d1d2", "status": "affected", "versionType": "git"}, {"version": "b185f01a9ab7af586133be2555298e960237359b", "lessThan": "e41bbbbb1740ce4d7270ab1cdeca13892d6a8d2e", "status": "affected", "versionType": "git"}, {"version": "b185f01a9ab7af586133be2555298e960237359b", "lessThan": "c2e819be6a5c7f34344926b4bd7e3dfca58cf48a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/f_printer.c"], "versions": [{"version": "4.1", "status": "affected"}, {"version": "0", "lessThan": "4.1", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3f81197364b57e5318620c75f3bd63f405f60552"}, {"url": "https://git.kernel.org/stable/c/e225e2998e5a9b83c838dbbe4511fb0d63f88daf"}, {"url": "https://git.kernel.org/stable/c/3081b0e187065c3b9577e393ad664b12854aeaf3"}, {"url": "https://git.kernel.org/stable/c/994afccfdcceb73be33f69a8a8ea71e260c9eca5"}, {"url": "https://git.kernel.org/stable/c/e03597ad9494b500344076589aeaa6c6d2d381d3"}, {"url": "https://git.kernel.org/stable/c/4cde0b38cc0cb8b7dc17295801015148de37d1d2"}, {"url": "https://git.kernel.org/stable/c/e41bbbbb1740ce4d7270ab1cdeca13892d6a8d2e"}, {"url": "https://git.kernel.org/stable/c/c2e819be6a5c7f34344926b4bd7e3dfca58cf48a"}], "title": "usb: gadget: printer: fix infinite loop in printer_read()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/gadget/function/f_printer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3f81197364b57e5318620c75f3bd63f405f60552", "status": "affected", "version": "b185f01a9ab7af586133be2555298e960237359b", "versionType": "git"}, {"lessThan": "e225e2998e5a9b83c838dbbe4511fb0d63f88daf", "status": "affected", "version": "b185f01a9ab7af586133be2555298e960237359b", "versionType": "git"}, {"lessThan": "3081b0e187065c3b9577e393ad664b12854aeaf3", "status": "affected", "version": "b185f01a9ab7af586133be2555298e960237359b", "versionType": "git"}, {"lessThan": "994afccfdcceb73be33f69a8a8ea71e260c9eca5", "status": "affected", "version": "b185f01a9ab7af586133be2555298e960237359b", "versionType": "git"}, {"lessThan": "e03597ad9494b500344076589aeaa6c6d2d381d3", "status": "affected", "version": "b185f01a9ab7af586133be2555298e960237359b", "versionType": "git"}, {"lessThan": "4cde0b38cc0cb8b7dc17295801015148de37d1d2", "status": "affected", "version": "b185f01a9ab7af586133be2555298e960237359b", "versionType": "git"}, {"lessThan": "e41bbbbb1740ce4d7270ab1cdeca13892d6a8d2e", "status": "affected", "version": "b185f01a9ab7af586133be2555298e960237359b", "versionType": "git"}, {"lessThan": "c2e819be6a5c7f34344926b4bd7e3dfca58cf48a", "status": "affected", "version": "b185f01a9ab7af586133be2555298e960237359b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/gadget/function/f_printer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.1"}, {"lessThan": "4.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: printer: fix infinite loop in printer_read()\n\nprinter_read() uses the same variable for the requested copy size and\nthe number of bytes actually copied to user space. copy_to_user()\nreturns the number of bytes not copied, so when it fails to copy\nanything, the computed copied length becomes zero.\n\nIn that case len, buf, current_rx_bytes and current_rx_buf are left\nunchanged. If RX data is available and the user buffer remains\nunwritable, the read loop can repeat indefinitely.\n\nTrack the copied length separately and return -EFAULT, or the number of\nbytes already copied, if an iteration makes no progress."}], "id": "CVE-2026-68369", "lastModified": "2026-08-19T17:20:46.477", "metrics": {}, "published": "2026-08-10T13:20:29.670", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3081b0e187065c3b9577e393ad664b12854aeaf3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3f81197364b57e5318620c75f3bd63f405f60552"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4cde0b38cc0cb8b7dc17295801015148de37d1d2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/994afccfdcceb73be33f69a8a8ea71e260c9eca5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c2e819be6a5c7f34344926b4bd7e3dfca58cf48a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e03597ad9494b500344076589aeaa6c6d2d381d3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e225e2998e5a9b83c838dbbe4511fb0d63f88daf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e41bbbbb1740ce4d7270ab1cdeca13892d6a8d2e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux Kernel: Denial of Service in USB gadget printer driver due to infinite loop", "id": "2513276", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513276"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nusb: gadget: printer: fix infinite loop in printer_read()\nprinter_read() uses the same variable for the requested copy size and\nthe number of bytes actually copied to user space. copy_to_user()\nreturns the number of bytes not copied, so when it fails to copy\nanything, the computed copied length becomes zero.\nIn that case len, buf, current_rx_bytes and current_rx_buf are left\nunchanged. If RX data is available and the user buffer remains\nunwritable, the read loop can repeat indefinitely.\nTrack the copied length separately and return -EFAULT, or the number of\nbytes already copied, if an iteration makes no progress.", "A flaw was found in the Linux kernel's USB gadget printer driver. An attacker, by providing specific input to the `printer_read()` function, could trigger an infinite loop. This vulnerability occurs when the `copy_to_user()` function fails to copy data, leading to a denial of service condition where the system becomes unresponsive."], "name": "CVE-2026-68369", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:03:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68369\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68369\nhttps://git.kernel.org/stable/c/4cde0b38cc0cb8b7dc17295801015148de37d1d2\nhttps://git.kernel.org/stable/c/994afccfdcceb73be33f69a8a8ea71e260c9eca5\nhttps://git.kernel.org/stable/c/c2e819be6a5c7f34344926b4bd7e3dfca58cf48a\nhttps://git.kernel.org/stable/c/e03597ad9494b500344076589aeaa6c6d2d381d3\nhttps://git.kernel.org/stable/c/e41bbbbb1740ce4d7270ab1cdeca13892d6a8d2e"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b185f01a9ab7af586133be2555298e960237359b,994afccfdcceb73be33f69a8a8ea71e260c9eca5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b185f01a9ab7af586133be2555298e960237359b,e03597ad9494b500344076589aeaa6c6d2d381d3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b185f01a9ab7af586133be2555298e960237359b,4cde0b38cc0cb8b7dc17295801015148de37d1d2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b185f01a9ab7af586133be2555298e960237359b,e41bbbbb1740ce4d7270ab1cdeca13892d6a8d2e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b185f01a9ab7af586133be2555298e960237359b,c2e819be6a5c7f34344926b4bd7e3dfca58cf48a)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.148,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T17:30:17.998394+00:00", "updated": "2026-08-13T07:00:12.934062+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}