CVE-2026-98025

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98025", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.070Z", "datePublished": "2026-09-25T10:23:43.906Z", "dateUpdated": "2026-10-19T09:12:30.354Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:12:30.354Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow\n\nThe 0xffff length sentinel detects a router reboot and schedules\nre-enabling of ethernet mode, but then falls through to the rest\nof the loop body. The next check is\n\n\t} else if (len > CX82310_MTU) {\n\nwhich is the else of the just-matched if -- it never fires for\nlen == 0xffff. The MTU bound that normally caps the\nincomplete-packet save path is silently bypassed.\n\nWith 0xffff > skb->len always true (rx_urb_size is 4096), the\nincomplete-packet branch saves dev->partial_len = skb->len bytes\ninto dev->partial_data. partial_data is kmalloc(hard_mtu) =\nkmalloc(CX82310_MTU + 2) = 1516 bytes, but skb->len after the\n2-byte header pull can be up to 4094. A device that sends a\n4096-byte URB starting with [0xff 0xff] therefore copies 4094\ndevice-provided bytes into a buffer allocated for 1516 bytes,\nexceeding its requested size by 2578 bytes.\n\nThe next URB then reads dev->partial_len (4094) back from the same\n1516-byte buffer and dev->partial_rem (65535 - 4094 = 61441) from\nthe new URB's ~4KB skb, both well past their allocations, and\ndelivers the spliced result as a 64KB \"frame\" to the network\nstack.\n\nBail out of rx_fixup after scheduling the re-enable work; the\nremainder of a reboot-marker URB is not meaningful packet data.\nThis restores the invariant that partial_len < CX82310_MTU + 2 on\nthe save path, since every other route there has already passed\nthe MTU check."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/usb/cx82310_eth.c"], "versions": [{"version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "lessThan": "d0c1ce6ef4cefe568e19afa83f543caa3c3c0873", "status": "affected", "versionType": "git"}, {"version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "lessThan": "0dbc89e664b4609ad672b5bdeef60df251294b8f", "status": "affected", "versionType": "git"}, {"version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "lessThan": "00520cdd21ea6a9b5dc8d53bbd241620d2059554", "status": "affected", "versionType": "git"}, {"version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "lessThan": "59bf9e94bdc49557f07d87164269daff7340f4d6", "status": "affected", "versionType": "git"}, {"version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "lessThan": "3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287", "status": "affected", "versionType": "git"}, {"version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "lessThan": "659654654eb140851467af41d610473c100c7975", "status": "affected", "versionType": "git"}, {"version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "lessThan": "237c9ae7145772af147e4665f158938350fa5658", "status": "affected", "versionType": "git"}, {"version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "lessThan": "5d50e90add8b4a978395e893e81954d19d58a7c5", "status": "affected", "versionType": "git"}, {"version": "5adf7fbdfa3e9e425b04771e1d64c4e184ad8fdb", "status": "affected", "versionType": "git"}, {"version": "c1b187a86a176e42f5e48066556980e3232b6cab", "status": "affected", "versionType": "git"}, {"version": "4.19.322", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.284", "lessThan": "5.5", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/usb/cx82310_eth.c"], "versions": [{"version": "5.10", "status": "affected"}, {"version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.322"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.284"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d0c1ce6ef4cefe568e19afa83f543caa3c3c0873"}, {"url": "https://git.kernel.org/stable/c/0dbc89e664b4609ad672b5bdeef60df251294b8f"}, {"url": "https://git.kernel.org/stable/c/00520cdd21ea6a9b5dc8d53bbd241620d2059554"}, {"url": "https://git.kernel.org/stable/c/59bf9e94bdc49557f07d87164269daff7340f4d6"}, {"url": "https://git.kernel.org/stable/c/3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287"}, {"url": "https://git.kernel.org/stable/c/659654654eb140851467af41d610473c100c7975"}, {"url": "https://git.kernel.org/stable/c/237c9ae7145772af147e4665f158938350fa5658"}, {"url": "https://git.kernel.org/stable/c/5d50e90add8b4a978395e893e81954d19d58a7c5"}], "title": "net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/usb/cx82310_eth.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d0c1ce6ef4cefe568e19afa83f543caa3c3c0873", "status": "affected", "version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "versionType": "git"}, {"lessThan": "0dbc89e664b4609ad672b5bdeef60df251294b8f", "status": "affected", "version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "versionType": "git"}, {"lessThan": "00520cdd21ea6a9b5dc8d53bbd241620d2059554", "status": "affected", "version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "versionType": "git"}, {"lessThan": "59bf9e94bdc49557f07d87164269daff7340f4d6", "status": "affected", "version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "versionType": "git"}, {"lessThan": "3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287", "status": "affected", "version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "versionType": "git"}, {"lessThan": "659654654eb140851467af41d610473c100c7975", "status": "affected", "version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "versionType": "git"}, {"lessThan": "237c9ae7145772af147e4665f158938350fa5658", "status": "affected", "version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "versionType": "git"}, {"lessThan": "5d50e90add8b4a978395e893e81954d19d58a7c5", "status": "affected", "version": "ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808", "versionType": "git"}, {"status": "affected", "version": "5adf7fbdfa3e9e425b04771e1d64c4e184ad8fdb", "versionType": "git"}, {"status": "affected", "version": "c1b187a86a176e42f5e48066556980e3232b6cab", "versionType": "git"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.322", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.284", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/usb/cx82310_eth.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"lessThan": "5.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow\n\nThe 0xffff length sentinel detects a router reboot and schedules\nre-enabling of ethernet mode, but then falls through to the rest\nof the loop body. The next check is\n\n\t} else if (len > CX82310_MTU) {\n\nwhich is the else of the just-matched if -- it never fires for\nlen == 0xffff. The MTU bound that normally caps the\nincomplete-packet save path is silently bypassed.\n\nWith 0xffff > skb->len always true (rx_urb_size is 4096), the\nincomplete-packet branch saves dev->partial_len = skb->len bytes\ninto dev->partial_data. partial_data is kmalloc(hard_mtu) =\nkmalloc(CX82310_MTU + 2) = 1516 bytes, but skb->len after the\n2-byte header pull can be up to 4094. A device that sends a\n4096-byte URB starting with [0xff 0xff] therefore copies 4094\ndevice-provided bytes into a buffer allocated for 1516 bytes,\nexceeding its requested size by 2578 bytes.\n\nThe next URB then reads dev->partial_len (4094) back from the same\n1516-byte buffer and dev->partial_rem (65535 - 4094 = 61441) from\nthe new URB's ~4KB skb, both well past their allocations, and\ndelivers the spliced result as a 64KB \"frame\" to the network\nstack.\n\nBail out of rx_fixup after scheduling the re-enable work; the\nremainder of a reboot-marker URB is not meaningful packet data.\nThis restores the invariant that partial_len < CX82310_MTU + 2 on\nthe save path, since every other route there has already passed\nthe MTU check."}], "id": "CVE-2026-98025", "lastModified": "2026-10-19T10:17:56.440", "metrics": {}, "published": "2026-09-25T11:17:31.110", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/00520cdd21ea6a9b5dc8d53bbd241620d2059554"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0dbc89e664b4609ad672b5bdeef60df251294b8f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/237c9ae7145772af147e4665f158938350fa5658"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/59bf9e94bdc49557f07d87164269daff7340f4d6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5d50e90add8b4a978395e893e81954d19d58a7c5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/659654654eb140851467af41d610473c100c7975"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d0c1ce6ef4cefe568e19afa83f543caa3c3c0873"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow", "id": "2541097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541097"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow\nThe 0xffff length sentinel detects a router reboot and schedules\nre-enabling of ethernet mode, but then falls through to the rest\nof the loop body. The next check is\n} else if (len > CX82310_MTU) {\nwhich is the else of the just-matched if -- it never fires for\nlen == 0xffff. The MTU bound that normally caps the\nincomplete-packet save path is silently bypassed.\nWith 0xffff > skb->len always true (rx_urb_size is 4096), the\nincomplete-packet branch saves dev->partial_len = skb->len bytes\ninto dev->partial_data. partial_data is kmalloc(hard_mtu) =\nkmalloc(CX82310_MTU + 2) = 1516 bytes, but skb->len after the\n2-byte header pull can be up to 4094. A device that sends a\n4096-byte URB starting with [0xff 0xff] therefore copies 4094\ndevice-provided bytes into a buffer allocated for 1516 bytes,\nexceeding its requested size by 2578 bytes.\nThe next URB then reads dev->partial_len (4094) back from the same\n1516-byte buffer and dev->partial_rem (65535 - 4094 = 61441) from\nthe new URB's ~4KB skb, both well past their allocations, and\ndelivers the spliced result as a 64KB \"frame\" to the network\nstack.\nBail out of rx_fixup after scheduling the re-enable work; the\nremainder of a reboot-marker URB is not meaningful packet data.\nThis restores the invariant that partial_len < CX82310_MTU + 2 on\nthe save path, since every other route there has already passed\nthe MTU check.", "A flaw was found in the Linux kernel's cx82310_eth USB Ethernet driver. An attacker connecting a malicious USB device can trigger a heap-based buffer overflow by sending crafted packets containing a reboot indicator. Because the driver fails to discard the packet after detecting the reboot signal, it bypasses packet size checks and writes data beyond allocated memory bounds. This issue can cause a system crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution with kernel privileges."], "name": "CVE-2026-98025", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98025\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98025\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98025.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808,3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808,659654654eb140851467af41d610473c100c7975)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808,237c9ae7145772af147e4665f158938350fa5658)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ca139d76b0d9e59d18f2d2ec8f0d81b82acd6808,5d50e90add8b4a978395e893e81954d19d58a7c5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "5adf7fbdfa3e9e425b04771e1d64c4e184ad8fdb"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "c1b187a86a176e42f5e48066556980e3232b6cab"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.19.322,4.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.4.284,5.5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T16:30:15.789990+00:00", "updated": "2026-09-30T14:15:16.123802+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}