{"id":"CVE-2026-98597","revision":"4492f3470a484146a9d2de7df6bf15f6","records":[{"revision":"4492f3470a484146a9d2de7df6bf15f6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98597","aliases":[],"title":"net: usb: sr9700: include receive overhead in the length check","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: sr9700: include receive overhead in the length check\n\nThe receive fixup subtracts the Ethernet CRC from the reported packet\nlength, but compares that payload length against the whole remaining\nreceive buffer. The following copy starts after the three-byte header,\nand the cursor advance consumes both that header and the four-byte CRC.\n\nRequire the payload to fit after SR_RX_OVERHEAD before copying it or\nadvancing to the next packet. The loop already ensures that the\nremaining buffer is larger than the overhead, so the subtraction is\nsafe.\n\nThe issue was found by our static-analysis tool.","state":0,"publishedAt":"2026-10-18T15:19:10.088+00:00","modifiedAt":"2026-10-19T09:22:22.716+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/usb/sr9700.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c9b37458e95629b1d1171457afdcc1bf1eb7881d\",\n                            \"lessThan\": \"92d88c88390fc62444c00a1a22078f838e03891f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c9b37458e95629b1d1171457afdcc1bf1eb7881d\",\n                            \"lessThan\": \"baf07d5153d3af8f98e65e2d3566bc0d50c4e3ac\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c9b37458e95629b1d1171457afdcc1bf1eb7881d\",\n                            \"lessThan\": \"8488779d9bddbdb33588c9fc2c0657a3da773f61\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c9b37458e95629b1d1171457afdcc1bf1eb7881d\",\n                            \"lessThan\": \"e1f5b74edccf4c9b671b6bce4435a98746fe5167\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c9b37458e95629b1d1171457afdcc1bf1eb7881d\",\n                            \"lessThan\": \"9b59b00890c5dea355b4cc8795ab8eeafc044e48\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c9b37458e95629b1d1171457afdcc1bf1eb7881d\",\n                            \"lessThan\": \"6ab6c9d120b30c94579192ef83a581a3dda6d79c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c9b37458e95629b1d1171457afdcc1bf1eb7881d\",\n                            \"lessThan\": \"05b442709bd5256c6c0e11fe56b9a0cb2455c245\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c9b37458e95629b1d1171457afdcc1bf1eb7881d\",\n                            \"lessThan\": \"c06bde80ae7a7b595732f7cabcb92cf08db9d56a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/usb/sr9700.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/92d88c88390fc62444c00a1a22078f838e03891f","https://git.kernel.org/stable/c/baf07d5153d3af8f98e65e2d3566bc0d50c4e3ac","https://git.kernel.org/stable/c/8488779d9bddbdb33588c9fc2c0657a3da773f61","https://git.kernel.org/stable/c/e1f5b74edccf4c9b671b6bce4435a98746fe5167","https://git.kernel.org/stable/c/9b59b00890c5dea355b4cc8795ab8eeafc044e48","https://git.kernel.org/stable/c/6ab6c9d120b30c94579192ef83a581a3dda6d79c","https://git.kernel.org/stable/c/05b442709bd5256c6c0e11fe56b9a0cb2455c245","https://git.kernel.org/stable/c/c06bde80ae7a7b595732f7cabcb92cf08db9d56a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98597","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98597","identifiers":["CVE-2026-98597"]},"retained":false,"historicalAffected":[]}],"coverage":[]}