CVE-2026-98769
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd generic_set_cmd() and generic_get_cmd() use the low nibble of ctrl->bRequest as an index into con->data[]: u8 cmd = (ctrl->bRequest & 0x0F); /* 0 .. 15 */ ... con->data[cmd] = value; /* OOB when cmd >= 5 */ struct usb_audio_control (include/linux/usb/audio.h) declares data as a 5-element array, so indices 5 through 15 write (or read) up to 44 bytes past the end of the array on the heap. A malicious USB host can craft a class-specific SET_CUR / GET_CUR request with an arbitrary bRequest value, triggering the out-of-bounds access from an IRQ completion handler with no further preconditions. Add an ARRAY_SIZE() guard to both functions.
Affected versions
Linux kernel versions
2.6.31
and later are affected. Fixed in
6.12.113,
6.18.56,
7.2.10,
7.3
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-98769?
CVE-2026-98769 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.31 onward and has been patched in 6.12.113, 6.18.56, 7.2.10 and others. CVE-2026-98769 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98769?
Yes. CVE-2026-98769 has been patched. Fixed versions include 6.12.113, 6.18.56, 7.2.10 and others. If you are running Linux kernel 2.6.31 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98769 actively exploited?
No. CVE-2026-98769 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.