CVE-2026-68366

A flaw was found in the USB Video Class (UVC) gadget driver in the Linux kernel. The uvc_send_response() function, which constructs UVC control responses, fails to properly restrict the length of data copied into a response buffer. A remote attacker, by sending a specially crafted USB control request, could cause an out-of-bounds read. This could lead to information disclosure or a denial of service (DoS) on the affected system.

This issue affects USB UVC gadget mode. uvc_send_response() does not clamp user-supplied length to the response buffer. Systems not using UVC gadget are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.