CVE-2026-98612

A flaw was found in the Linux kernel's CATC USB Ethernet driver. The driver fails to properly validate packet length boundaries when processing incoming multi-packet network transfers. An attacker could exploit this flaw by providing crafted packet headers, causing the driver to read beyond the allocated buffer or read uninitialized memory. This vulnerability primarily results in a system crash, leading to a Denial of Service (DoS), and may potentially expose sensitive system memory.

Red Hat has evaluated this vulnerability as having a Moderate severity impact because exploitation requires physical access to connect a malicious USB device or the ability to attach emulated hardware to a virtual guest. In typical enterprise deployments, the affected driver is not loaded unless specific CATC USB hardware is physically attached. While an attacker capable of presenting crafted device packets could trigger a kernel panic or potentially read uninitialized memory, this flaw cannot be exploited across the network without access to the USB bus.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.