CVE-2026-98597

A flaw was found in the Linux kernel's sr9700 USB Ethernet driver. When processing incoming packets, the driver fails to properly account for packet header overhead during buffer length validation. An attacker capable of sending crafted packet data could trigger an out-of-bounds read, leading to a Denial of Service (DoS) via a system crash.

This vulnerability is evaluated as Moderate impact because exploitation requires an attacker to send malformed network packets to an active SR9700 USB Ethernet interface, with the impact confined to a system crash (denial of service). In standard Red Hat Enterprise Linux installations and cloud environments, this driver is not loaded by default and the corresponding hardware is rarely deployed. The vulnerability is only exposed if the SR9700 device is connected and its driver is initialized.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.