CVE-2026-98597

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: net: usb: sr9700: include receive overhead in the length check The receive fixup subtracts the Ethernet CRC from the reported packet length, but compares that payload length against the whole remaining receive buffer. The following copy starts after the three-byte header, and the cursor advance consumes both that header and the four-byte CRC. Require the payload to fit after SR_RX_OVERHEAD before copying it or advancing to the next packet. The loop already ensures that the remaining buffer is larger than the overhead, so the subtraction is safe. The issue was found by our static-analysis tool.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-10-18 16:17:12.387000

Last modified

2026-10-19 10:19:21.057000

View original CVE JSON

{
  "id": "CVE-2026-98597",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-10-18T16:17:12.387",
  "lastModified": "2026-10-19T10:19:21.057",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: sr9700: include receive overhead in the length check\n\nThe receive fixup subtracts the Ethernet CRC from the reported packet\nlength, but compares that payload length against the whole remaining\nreceive buffer. The following copy starts after the three-byte header,\nand the cursor advance consumes both that header and the four-byte CRC.\n\nRequire the payload to fit after SR_RX_OVERHEAD before copying it or\nadvancing to the next packet. The loop already ensures that the\nremaining buffer is larger than the overhead, so the subtraction is\nsafe.\n\nThe issue was found by our static-analysis tool."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/net/usb/sr9700.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
              "lessThan": "92d88c88390fc62444c00a1a22078f838e03891f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
              "lessThan": "baf07d5153d3af8f98e65e2d3566bc0d50c4e3ac",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
              "lessThan": "8488779d9bddbdb33588c9fc2c0657a3da773f61",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
              "lessThan": "e1f5b74edccf4c9b671b6bce4435a98746fe5167",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
              "lessThan": "9b59b00890c5dea355b4cc8795ab8eeafc044e48",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
              "lessThan": "6ab6c9d120b30c94579192ef83a581a3dda6d79c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
              "lessThan": "05b442709bd5256c6c0e11fe56b9a0cb2455c245",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c9b37458e95629b1d1171457afdcc1bf1eb7881d",
              "lessThan": "c06bde80ae7a7b595732f7cabcb92cf08db9d56a",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/net/usb/sr9700.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "3.12",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.12",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.271",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.222",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.189",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.158",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.112",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.55",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.9",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/05b442709bd5256c6c0e11fe56b9a0cb2455c245",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6ab6c9d120b30c94579192ef83a581a3dda6d79c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8488779d9bddbdb33588c9fc2c0657a3da773f61",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/92d88c88390fc62444c00a1a22078f838e03891f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9b59b00890c5dea355b4cc8795ab8eeafc044e48",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/baf07d5153d3af8f98e65e2d3566bc0d50c4e3ac",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c06bde80ae7a7b595732f7cabcb92cf08db9d56a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e1f5b74edccf4c9b671b6bce4435a98746fe5167",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}