CVE-2026-97539

A moderate-impact out-of-bounds read flaw was found in the Linux kernel xusbatm USB ATM driver used in Red Hat Enterprise Linux and the OpenShift Container Platform RHEL CoreOS kernels. The driver derives a configuration index by performing pointer arithmetic between the usb_device_id passed to its probe routine and its static USB device ID table. When a dynamic device ID is registered, the probe's usb_device_id is heap-allocated, so this arithmetic produces a wildly out-of-bounds index into the driver's configuration arrays. A local user able to register a dynamic device ID for the xusbatm driver and match a USB device could use this flaw to trigger an out-of-bounds kernel memory read, resulting in a kernel crash and denial of service; memory corruption is also possible. The kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, and 9 and the RHEL CoreOS kernels shipped with OpenShift Container Platform are affected, with the fix deferred: exploitation requires privileged local access to register a dynamic USB device ID, so the issue is a local denial of service with limited practical exposure, and the fix will be delivered in a future update. Red Hat Enterprise Linux 6 is out of support scope. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those products.