{"cve":"CVE-2026-68366","nvd":{"published":"2026-08-10T13:20:29.230","modified":"2026-08-19T17:20:46.203","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer\n\nuvc_send_response() builds the UVC control response from a user-supplied\nstruct uvc_request_data:\n\n\treq->length = min_t(unsigned int, uvc->event_length, data->length);\n\t...\n\tmemcpy(req->buf, data->data, req->length);\n\nreq->length is clamped to uvc->event_length, which is taken from the\nhost control request wLength (up to UVC_MAX_REQUEST_SIZE, 64), and to\ndata->length, which comes from the UVCIOC_SEND_RESPONSE ioctl and is\nonly checked for being negative.  The source buffer data->data is only\n60 bytes, so a response with uvc->event_length and data->length both\ngreater than 60 makes memcpy() read past the end of data->data.\n\nClamp req->length to sizeof(data->data) as well.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/1f03658f3e9b2f8fd1d1003ba389a0390b49a350","https://git.kernel.org/stable/c/4e116372b7a4f87df0dc0ed4b0ab5b0bb0cc5796","https://git.kernel.org/stable/c/568e68d8f80395a64848aa2946af8ade72da0ffb","https://git.kernel.org/stable/c/662f6c6c6ff8a6c508e1646c09cae74e28f3cca6","https://git.kernel.org/stable/c/82ec2c1e456b17451f0736c3983402642f961733"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:47:54.990491175+00:00"},"epss":{"cve":"CVE-2026-68366","score":0.00184,"percentile":0.08025,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}