CVE-2026-74681 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT endpoint size. Both are taken independently from different endpoints in usbio_probe(), so the check is wrong when they differ.
Use rxbuf_len for the IN direction. This matches the buffer that actually holds the response data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel vulnerability identified within the usbmisc driver, specifically affecting the usbio module, represents a critical logic error in input validation during bulk transfer operations. The core of this issue lies in the function usbio_bulk_msg, which is responsible for handling USB bulk messages that involve data transmission between the host and peripheral devices. In standard USB communication protocols, there are distinct endpoints for sending data (bulk OUT) and receiving data (bulk IN). Each endpoint typically has its own buffer size configuration determined during device initialization or probing phases. The vulnerability arises because the code incorrectly validates the length of incoming data against a parameter intended for outgoing data transfers rather than the actual receive buffer capacity.
During the probe phase, usbio_probe initializes two separate variables: ibuf_len and txbuf_len. The variable ibuf_len corresponds to the size of the bulk IN endpoint buffer, which is used when receiving data from the device. Conversely, txbuf_len represents the size of the bulk OUT endpoint buffer, utilized for sending commands or data to the device. These values are derived independently based on the specific capabilities and configurations reported by the connected USB hardware. Under normal circumstances where both endpoints might share similar constraints, this oversight may not trigger immediate failures. However, in scenarios involving devices with asymmetric buffer sizes, such as high-speed peripherals or specialized industrial equipment, the discrepancy becomes significant.
The technical flaw manifests when usbio_bulk_msg performs a bounds check on ibuf_len to prevent buffer overflows. The code erroneously compares ibuf_len against txbuf_len using an EMSGSIZE error condition. This comparison is logically invalid because it checks if the incoming data size exceeds the outgoing buffer limit rather than the incoming buffer limit. If a device sends more data than what fits in its own IN endpoint buffer, but that amount happens to be smaller than or equal to the OUT endpoint's capacity, the validation will pass incorrectly. Consequently, subsequent operations may attempt to write received data into a memory region sized according to ibuf_len, potentially leading to heap corruption if the actual data exceeds ibuf_len while passing the flawed txbuf_len check. Alternatively, it could lead to truncated reads or protocol errors if the logic assumes compatibility that does not exist in asymmetric configurations.
From an operational impact perspective, this vulnerability can result in memory safety violations such as buffer overflows, which are prime vectors for arbitrary code execution attacks. An attacker with physical access to a USB port or who controls a malicious peripheral could exploit this mismatch by sending carefully crafted bulk IN responses that exceed the intended receive buffer size but remain within the transmit buffer limit. This would allow the injection of malformed data into kernel memory spaces, potentially compromising system integrity and confidentiality. Furthermore, even without exploitation for code execution, the bug can cause unstable device behavior, including driver crashes or hangs, leading to denial-of-service conditions for systems relying on these USB devices for critical operations.
This vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to properly verify that input data conforms to expected constraints before processing it. Specifically, it involves validating against incorrect parameters rather than the relevant resource limits. In terms of attack vectors and techniques, this falls under ATT&CK T1564 Hidden Elements or potentially T1203 Exploitation for Defense Evasion if leveraged in a broader exploit chain to bypass security controls by triggering unexpected kernel states. The misconfiguration essentially creates an inconsistency between the declared resource limits and the enforced validation logic, allowing inputs that should be rejected to proceed unchecked.
To mitigate this risk, developers must ensure that input validation checks strictly correspond to the specific buffer or resource being accessed during each direction of communication. In this case, replacing txbuf_len with rxbuf_len in the EMSGSIZE check within usbio_bulk_msg ensures that incoming data is validated against its actual destination capacity. This correction guarantees that any attempt to receive more data than the IN endpoint can handle will be properly rejected before memory operations occur. System administrators and users should apply kernel updates provided by their distribution vendors as soon as patches are available, ensuring that the corrected logic is deployed across all affected systems. Regular auditing of USB driver code for similar asymmetric buffer handling issues is also recommended to prevent recurrence in other modules within the usbmisc subsystem or related drivers.