Out-of-bounds read in Linux kernel - CVE-2026-98612

Vulnerability identifier: #VU156919

CSH Severity: Medium

CVSS v4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98612

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker with physical access to system to potentially cause a denial of service or disclose kernel memory.

The vulnerability exists due to out-of-bounds reads and acceptance of undersized packets in the Linux kernel's catc_rx_done() function when processing USB receive transfers. An attacker with physical access to system can supply malformed packet lengths or truncated transfers to trigger reads beyond the receive buffer or from uninitialized socket-buffer tailroom, potentially causing a kernel crash or memory disclosure.

Linux kernel
Ubuntu
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia-tegra (Ubuntu package) - update to 5.15.0-1070.72
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux (Ubuntu package) - update to 7.0.0-42.42
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/21e206dd88b3de6e36bb607dec3797c59bc3007b
• https://git.kernel.org/stable/c/2f87bbd5a7bf6ee79d598f7e22cf77810d29ae87
• https://git.kernel.org/stable/c/3942557938f846e7481f6ccb2b41ccbdee61baa1
• https://git.kernel.org/stable/c/4cc0a8eb2f9336cfa3e4ac329bc5585ca970ced3
• https://git.kernel.org/stable/c/801e21cf7dd6bcee31db907625d5045f21c9c1d9
• https://git.kernel.org/stable/c/9d4be026bdff2c1da7b6c7e01c0a47f2df409e97
• https://git.kernel.org/stable/c/9d565b6b72fe3f41fd43636e143072848105189f
• https://git.kernel.org/stable/c/dd9c6f8f05170223edec2dac476606cd40d9acb7

• Out-of-bounds read in Linux kernel net usb driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx
• Ubuntu update for linux, linux-aws, linux-aws-5.15 and more