CVE-2026-97539

A flaw was found in the Linux kernel's xusbatm USB driver. When dynamic device identifiers are configured, the driver improperly performs pointer arithmetic on heap-allocated identifiers, resulting in an out-of-bounds array access. A local user could exploit this flaw to cause a Denial of Service (DoS) through a system crash or potentially corrupt kernel memory.

A moderate-impact out-of-bounds read flaw was found in the Linux kernel xusbatm USB ATM driver used in Red Hat Enterprise Linux and the OpenShift Container Platform RHEL CoreOS kernels. The driver derives a configuration index by performing pointer arithmetic between the usb_device_id passed to its probe routine and its static USB device ID table. When a dynamic device ID is registered, the probe's usb_device_id is heap-allocated, so this arithmetic produces a wildly out-of-bounds index into the driver's configuration arrays. A local user able to register a dynamic device ID for the xusbatm driver and match a USB device could use this flaw to trigger an out-of-bounds kernel memory read, resulting in a kernel crash and denial of service; memory corruption is also possible. The kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, and 9 and the RHEL CoreOS kernels shipped with OpenShift Container Platform are affected, with the fix deferred: exploitation requires privileged local access to register a dynamic USB device ID, so the issue is a local denial of service with limited practical exposure, and the fix will be delivered in a future update. Red Hat Enterprise Linux 6 is out of support scope. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.