CVE-2026-74681

A flaw was found in the Linux kernel's USB subsystem, specifically within the usbio module. An incorrect buffer size validation occurs in the usbio_bulk_msg() function, where the bulk IN (receive) buffer size is mistakenly compared against the bulk OUT endpoint size instead of the actual receive buffer size. This discrepancy can lead to an erroneous size check, potentially causing unexpected behavior or a denial of service when processing USB bulk messages.

usbio_bulk_msg() checks the requested IN buffer length against txbuf_len instead of rxbuf_len, even though the receive buffer size is taken independently from the bulk IN endpoint. If rxbuf_len is smaller than txbuf_len, a request that is valid for the OUT endpoint can exceed the actual receive buffer and may lead to an out of bounds write or memory corruption in the USBIO receive path. For the CVSS the PR:L is used for the paranoid score because a local process may be able to trigger affected USBIO operations once the device is present, while the base case is a malicious or malformed physical USB device. The issue is not network reachable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.