CVE-2026-74681

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74681", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.925Z", "datePublished": "2026-08-22T15:32:48.873Z", "dateUpdated": "2026-08-22T15:32:48.873Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:32:48.873Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg\n\nibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check\nin usbio_bulk_msg() compares it against txbuf_len \u2014 the bulk OUT\nendpoint size. Both are taken independently from different endpoints\nin usbio_probe(), so the check is wrong when they differ.\n\nUse rxbuf_len for the IN direction. This matches the buffer that\nactually holds the response data."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/misc/usbio.c"], "versions": [{"version": "121a0f839dbb397af5fabb701cea3e9983223e50", "lessThan": "ebfd1e82ab0a6d26efd9bdd89de899215851f5bf", "status": "affected", "versionType": "git"}, {"version": "121a0f839dbb397af5fabb701cea3e9983223e50", "lessThan": "9ad0164f78b66b0b5eca3a5748cc94dd87e28124", "status": "affected", "versionType": "git"}, {"version": "121a0f839dbb397af5fabb701cea3e9983223e50", "lessThan": "7e22c9f79b200672f3e477421b6c9050d8cf70a5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/misc/usbio.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ebfd1e82ab0a6d26efd9bdd89de899215851f5bf"}, {"url": "https://git.kernel.org/stable/c/9ad0164f78b66b0b5eca3a5748cc94dd87e28124"}, {"url": "https://git.kernel.org/stable/c/7e22c9f79b200672f3e477421b6c9050d8cf70a5"}], "title": "usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/misc/usbio.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ebfd1e82ab0a6d26efd9bdd89de899215851f5bf", "status": "affected", "version": "121a0f839dbb397af5fabb701cea3e9983223e50", "versionType": "git"}, {"lessThan": "9ad0164f78b66b0b5eca3a5748cc94dd87e28124", "status": "affected", "version": "121a0f839dbb397af5fabb701cea3e9983223e50", "versionType": "git"}, {"lessThan": "7e22c9f79b200672f3e477421b6c9050d8cf70a5", "status": "affected", "version": "121a0f839dbb397af5fabb701cea3e9983223e50", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/misc/usbio.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg\n\nibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check\nin usbio_bulk_msg() compares it against txbuf_len \u2014 the bulk OUT\nendpoint size. Both are taken independently from different endpoints\nin usbio_probe(), so the check is wrong when they differ.\n\nUse rxbuf_len for the IN direction. This matches the buffer that\nactually holds the response data."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: misc: usbio: verificar ibuf_len contra rxbuf_len en el mensaje bulk\n\nibuf_len es el tama\u00f1o del b\u00fafer IN (recepci\u00f3n) bulk, pero la verificaci\u00f3n EMSGSIZE en usbio_bulk_msg() lo compara con txbuf_len - el tama\u00f1o del endpoint OUT bulk. Ambos se toman independientemente de diferentes endpoints en usbio_probe(), por lo que la verificaci\u00f3n es incorrecta cuando difieren.\n\nUsar rxbuf_len para la direcci\u00f3n IN. Esto coincide con el b\u00fafer que realmente contiene los datos de respuesta."}], "id": "CVE-2026-74681", "lastModified": "2026-10-14T13:10:00.187", "metrics": {}, "published": "2026-08-22T16:16:42.373", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7e22c9f79b200672f3e477421b6c9050d8cf70a5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9ad0164f78b66b0b5eca3a5748cc94dd87e28124"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ebfd1e82ab0a6d26efd9bdd89de899215851f5bf"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg", "id": "2521418", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521418"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nusb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg\nibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check\nin usbio_bulk_msg() compares it against txbuf_len \u2014 the bulk OUT\nendpoint size. Both are taken independently from different endpoints\nin usbio_probe(), so the check is wrong when they differ.\nUse rxbuf_len for the IN direction. This matches the buffer that\nactually holds the response data.", "A flaw was found in the Linux kernel's USB subsystem, specifically within the `usbio` module. An incorrect buffer size validation occurs in the `usbio_bulk_msg()` function, where the bulk IN (receive) buffer size is mistakenly compared against the bulk OUT endpoint size instead of the actual receive buffer size. This discrepancy can lead to an erroneous size check, potentially causing unexpected behavior or a denial of service when processing USB bulk messages."], "name": "CVE-2026-74681", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74681\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74681\nhttps://lore.kernel.org/linux-cve-announce/2026082231-CVE-2026-74681-f31c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[121a0f839dbb397af5fabb701cea3e9983223e50,ebfd1e82ab0a6d26efd9bdd89de899215851f5bf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[121a0f839dbb397af5fabb701cea3e9983223e50,9ad0164f78b66b0b5eca3a5748cc94dd87e28124)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[121a0f839dbb397af5fabb701cea3e9983223e50,7e22c9f79b200672f3e477421b6c9050d8cf70a5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T19:00:14.811551+00:00", "updated": "2026-08-25T17:15:05.692687+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}