Riskcovery

CVE-2026-74681

usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg

State
Published
Severity
Not scored
Published
Aug 22, 2026
Updated
Aug 22, 2026
Reserved
Aug 15, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg

ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT endpoint size. Both are taken independently from different endpoints in usbio_probe(), so the check is wrong when they differ.

Use rxbuf_len for the IN direction. This matches the buffer that actually holds the response data.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 121a0f839dbb397af5fabb701cea3e9983223e50 to before ebfd1e82ab0a6d26efd9bdd89de899215851f5bfAffected
  • 121a0f839dbb397af5fabb701cea3e9983223e50 to before 9ad0164f78b66b0b5eca3a5748cc94dd87e28124Affected
  • 121a0f839dbb397af5fabb701cea3e9983223e50 to before 7e22c9f79b200672f3e477421b6c9050d8cf70a5Affected
LinuxLinux
  • 6.18Affected
  • before 6.18Not affected
  • 6.18.45 through 6.18.*Not affected
  • 7.1.9 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.