CVE-2026-97539 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: xusbatm: don't rely on id table pointer arithmetic
The current code is broken when dynamic ID is involved; in such cases usb_device_id parameter of probe lives on the heap and the pointer arithmetic will get an index that is wildly out of bound. xusbatm initialize the USB device IDs dynamically so it can just use driver_info too.
Even with conversion, xusbatm still cannot support dynamic IDs, so also set no_dynamic_id.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel vulnerability in the usb_xusbatm driver represents a critical memory safety flaw rooted in improper pointer arithmetic when handling dynamically allocated USB device identifiers. The core issue arises from the assumption that the structure containing USB device identification data is contiguous and static, allowing for index calculation via pointer subtraction or addition relative to a base address. This architectural assumption holds true only for statically defined ID tables embedded within the kernel image at compile time. However, when dynamic IDs are utilized, the usb_device_id structures reside on the heap rather than in fixed memory segments. In such scenarios, performing arithmetic operations on pointers that point into these dynamically allocated arrays leads to undefined behavior because the relative offsets between elements cannot be reliably calculated using standard pointer math intended for static arrays. This results in an index calculation that is wildly out of bounds, potentially accessing memory regions far beyond the intended array boundaries.
This out-of-bounds access constitutes a severe security risk classified under CWE-125 Out-of-bounds Read or CWE-787 Out-of-bounds Write depending on whether the code attempts to read from or write to the calculated invalid address. The operational impact of this flaw is significant as it can lead to kernel panics, system crashes, or more critically, arbitrary memory corruption that could be exploited by a local attacker with physical access to USB ports. An adversary could potentially craft malicious USB devices that trigger specific dynamic ID matching scenarios, thereby inducing the faulty pointer arithmetic and gaining control over execution flow through heap overflow techniques. This aligns with ATT&CK technique T1059 Command and Scripting Interpreter if exploitation leads to code execution, or more broadly falls under privilege escalation vectors where kernel memory corruption allows bypassing user-space restrictions.
The resolution implemented in this patch addresses the root cause by abandoning reliance on pointer arithmetic for ID table traversal entirely. Instead, the driver is modified to utilize the driver_info field within the usb_device_id structure directly. This approach decouples the identification logic from fragile address calculations and relies instead on explicit data fields designed for such purposes. Furthermore, recognizing that even with this conversion, supporting dynamic IDs remains problematic due to inherent limitations in how the USB subsystem handles these identifiers during probe operations, the patch also enforces a restriction by setting no_dynamic_id. This flag explicitly disables support for dynamically added device IDs, ensuring that only statically defined and verified ID tables are processed through the now-safe driver_info mechanism.
Mitigation strategies extend beyond this specific code fix to include broader kernel hardening practices. Administrators should ensure their systems are updated with patches addressing this vulnerability in the usb_xusbatm module. From a development perspective, enforcing strict adherence to safe memory access patterns and avoiding pointer arithmetic on dynamically allocated structures is essential. Static analysis tools configured to detect out-of-bounds accesses can help identify similar vulnerabilities early in the software lifecycle. Additionally, enabling kernel hardening features such as KASAN (Kernel Address Sanitizer) during testing phases can expose these types of memory corruption bugs before they reach production environments. The combination of code correction and operational restrictions like no_dynamic_id provides a robust defense against exploitation attempts targeting USB subsystem components that rely on complex device identification logic.