CVE-2026-68366usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer uvc_send_response() builds the UVC control response from a user-supplied struct uvc_request_data: req->length = min_t(unsigned int, uvc->event_length, data->length); ... memcpy(req->buf, data->data, req->length); req->length is clamped to uvc->event_length, which is taken from the host control request wLength (up to UVC_MAX_REQUEST_SIZE, 64), and to data->length, which comes from the UVCIOC_SEND_RESPONSE ioctl and is only checked for being negative. The source buffer data->data is only 60 bytes, so a response with uvc->event_length and data->length both greater than 60 makes memcpy() read past the end of data->data. Clamp req->length to sizeof(data->data) as well.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 before eaf783c005299a702f2cc96b08cd21ede081f098; from a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 before 568e68d8f80395a64848aa2946af8ade72da0ffb; from a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 before 82ec2c1e456b17451f0736c3983402642f961733; from a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 before 4e116372b7a4f87df0dc0ed4b0ab5b0bb0cc5796; from a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 before 662f6c6c6ff8a6c508e1646c09cae74e28f3cca6; from a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 before 1f03658f3e9b2f8fd1d1003ba389a0390b49a350; from a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 before c8510fbbea09ef0170b56b14dc2b5890dc75be07; from a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 before b70dc75e85ba968b7b76eebfe5d63000080b875b | CNA record |
References
- https://git.kernel.org/stable/c/eaf783c005299a702f2cc96b08cd21ede081f098
- https://git.kernel.org/stable/c/568e68d8f80395a64848aa2946af8ade72da0ffb
- https://git.kernel.org/stable/c/82ec2c1e456b17451f0736c3983402642f961733
- https://git.kernel.org/stable/c/4e116372b7a4f87df0dc0ed4b0ab5b0bb0cc5796
- https://git.kernel.org/stable/c/662f6c6c6ff8a6c508e1646c09cae74e28f3cca6
- https://git.kernel.org/stable/c/1f03658f3e9b2f8fd1d1003ba389a0390b49a350
- https://git.kernel.org/stable/c/c8510fbbea09ef0170b56b14dc2b5890dc75be07
- https://git.kernel.org/stable/c/b70dc75e85ba968b7b76eebfe5d63000080b875b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.