CVE-2026-98597 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
net: usb: sr9700: include receive overhead in the length check
The receive fixup subtracts the Ethernet CRC from the reported packet length, but compares that payload length against the whole remaining receive buffer. The following copy starts after the three-byte header, and the cursor advance consumes both that header and the four-byte CRC.
Require the payload to fit after SR_RX_OVERHEAD before copying it or advancing to the next packet. The loop already ensures that the remaining buffer is larger than the overhead, so the subtraction is safe.
The issue was found by our static-analysis tool.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel network subsystem contains a logic error within the SR9700 USB Ethernet driver that results in an improper length check during packet reception processing. This vulnerability stems from a miscalculation of buffer boundaries when handling incoming network frames. Specifically, the receive fixup routine is designed to strip protocol-specific headers and checksums before passing data up the stack or copying it into kernel memory buffers. In this instance, the code correctly subtracts the Ethernet Cyclic Redundancy Check (CRC) from the reported packet length to determine the payload size. However, the critical flaw lies in how this calculated payload length is validated against the available space in the receive buffer. The comparison incorrectly checks if the payload fits within the entire remaining receive buffer rather than accounting for the overhead bytes that must be skipped or consumed during processing.
The technical root cause involves a failure to account for SR_RX_OVERHEAD, which includes both a three-byte header and a four-byte CRC field totaling seven bytes of protocol-specific data. When the driver processes an incoming packet, it advances its internal cursor by consuming this overhead in addition to the payload itself. Because the length check does not reserve space for these overhead bytes before validating that the payload fits within the buffer, the validation passes even when there is insufficient room to safely copy the entire frame including its associated metadata. This discrepancy creates a scenario where subsequent memory operations may attempt to write beyond the allocated boundaries of the receive buffer. The issue was identified through static analysis tools designed to detect such boundary condition errors and logic flaws in low-level system code, highlighting the importance of rigorous automated verification for network driver implementations.
From an operational perspective, this vulnerability can lead to out-of-bounds memory writes or reads depending on how the subsequent copy operations are implemented relative to the buffer limits. If the kernel proceeds with copying data based on the flawed length validation, it may overwrite adjacent memory structures, potentially leading to kernel panics, denial of service conditions due to system instability, or in more severe scenarios, arbitrary code execution if an attacker can control the contents of the incoming network packets. Since this driver handles USB Ethernet devices, remote attackers could exploit this by sending specially crafted malicious frames that trigger the buffer overflow condition. The impact is particularly significant because it affects a widely used class of networking hardware and compromises the integrity of kernel memory space which should be strictly protected from user-space or external input manipulation.
This flaw aligns with CWE-190, Integer Overflow or Wrapup, as well as CWE-787 Out-of-bounds Write, given that the miscalculated length allows access beyond intended buffer limits. In terms of attack vectors and techniques, this vulnerability relates to ATT&CK technique T1556, specifically Modifying Cloud Compute Infrastructure or modifying network configurations if it leads to privilege escalation via kernel exploitation. Mitigation strategies primarily involve applying the upstream Linux kernel patch that corrects the length check logic. The fix ensures that the payload size is validated against the remaining buffer space after subtracting SR_RX_OVERHEAD, thereby guaranteeing that there is sufficient room for both the overhead and the data payload before any copying or cursor advancement occurs. System administrators should ensure their systems are updated to a kernel version where this patch has been integrated. Additionally, deploying network intrusion detection systems can help identify anomalous traffic patterns targeting USB Ethernet interfaces, although definitive protection requires the software update itself.