GHSA-WCWV-8F76-PQ3H
Vulnerability from github – Published: 2026-09-25 12:31 – Updated: 2026-09-25 12:31In the Linux kernel, the following vulnerability has been resolved:
net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
The 0xffff length sentinel detects a router reboot and schedules re-enabling of ethernet mode, but then falls through to the rest of the loop body. The next check is
} else if (len > CX82310_MTU) {
which is the else of the just-matched if -- it never fires for len == 0xffff. The MTU bound that normally caps the incomplete-packet save path is silently bypassed.
With 0xffff > skb->len always true (rx_urb_size is 4096), the incomplete-packet branch saves dev->partial_len = skb->len bytes into dev->partial_data. partial_data is kmalloc(hard_mtu) = kmalloc(CX82310_MTU + 2) = 1516 bytes, but skb->len after the 2-byte header pull can be up to 4094. A device that sends a 4096-byte URB starting with [0xff 0xff] therefore copies 4094 device-provided bytes into a buffer allocated for 1516 bytes, exceeding its requested size by 2578 bytes.
The next URB then reads dev->partial_len (4094) back from the same 1516-byte buffer and dev->partial_rem (65535 - 4094 = 61441) from the new URB's ~4KB skb, both well past their allocations, and delivers the spliced result as a 64KB "frame" to the network stack.
Bail out of rx_fixup after scheduling the re-enable work; the remainder of a reboot-marker URB is not meaningful packet data. This restores the invariant that partial_len < CX82310_MTU + 2 on the save path, since every other route there has already passed the MTU check.
{
"affected": [],
"aliases": [
"CVE-2026-98025"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-25T11:17:31Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow\n\nThe 0xffff length sentinel detects a router reboot and schedules\nre-enabling of ethernet mode, but then falls through to the rest\nof the loop body. The next check is\n\n\t} else if (len \u003e CX82310_MTU) {\n\nwhich is the else of the just-matched if -- it never fires for\nlen == 0xffff. The MTU bound that normally caps the\nincomplete-packet save path is silently bypassed.\n\nWith 0xffff \u003e skb-\u003elen always true (rx_urb_size is 4096), the\nincomplete-packet branch saves dev-\u003epartial_len = skb-\u003elen bytes\ninto dev-\u003epartial_data. partial_data is kmalloc(hard_mtu) =\nkmalloc(CX82310_MTU + 2) = 1516 bytes, but skb-\u003elen after the\n2-byte header pull can be up to 4094. A device that sends a\n4096-byte URB starting with [0xff 0xff] therefore copies 4094\ndevice-provided bytes into a buffer allocated for 1516 bytes,\nexceeding its requested size by 2578 bytes.\n\nThe next URB then reads dev-\u003epartial_len (4094) back from the same\n1516-byte buffer and dev-\u003epartial_rem (65535 - 4094 = 61441) from\nthe new URB\u0027s ~4KB skb, both well past their allocations, and\ndelivers the spliced result as a 64KB \"frame\" to the network\nstack.\n\nBail out of rx_fixup after scheduling the re-enable work; the\nremainder of a reboot-marker URB is not meaningful packet data.\nThis restores the invariant that partial_len \u003c CX82310_MTU + 2 on\nthe save path, since every other route there has already passed\nthe MTU check.",
"id": "GHSA-wcwv-8f76-pq3h",
"modified": "2026-09-25T12:31:33Z",
"published": "2026-09-25T12:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98025"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/237c9ae7145772af147e4665f158938350fa5658"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3bd689409bb1c93bdc6dd8ec6cbf5161bc4f0287"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5d50e90add8b4a978395e893e81954d19d58a7c5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/659654654eb140851467af41d610473c100c7975"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.