CVE-2026-98612
Description
A flaw was found in the Linux kernel's CATC USB Ethernet driver. The driver fails to properly validate packet length boundaries when processing incoming multi-packet network transfers. An attacker could exploit this flaw by providing crafted packet headers, causing the driver to read beyond the allocated buffer or read uninitialized memory. This vulnerability primarily results in a system crash, leading to a Denial of Service (DoS), and may potentially expose sensitive system memory.
Statement
Red Hat has evaluated this vulnerability as having a Moderate severity impact because exploitation requires physical access to connect a malicious USB device or the ability to attach emulated hardware to a virtual guest. In typical enterprise deployments, the affected driver is not loaded unless specific CATC USB hardware is physically attached. While an attacker capable of presenting crafted device packets could trigger a kernel panic or potentially read uninitialized memory, this flaw cannot be exploited across the network without access to the USB bus.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
