CVE-2026-68366 usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
A local attacker with USB gadget access can trigger a buffer over-read in the Linux kernel UVC driver, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68366?
CVE-2026-68366 is a memory corruption vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
uvc_send_response() builds the UVC control response from a user-supplied struct uvc_request_data:
req->length = min_t(unsigned int, uvc->event_length, data->length); ... memcpy(req->buf, data->data, req->length);
req->length is clamped to uvc->event_length, which is taken from the host control request wLength (up to UVC_MAX_REQUEST_SIZE, 64), and to data->length, which comes from the UVCIOC_SEND_RESPONSE ioctl and is only checked for being negative. The source buffer data->data is only 60 bytes, so a response with uvc->event_length and data->length both greater than 60 makes memcpy() read past the end of data->data.
Clamp req->length to sizeof(data->data) as well.
Which versions are affected by CVE-2026-68366?
How do I fix CVE-2026-68366?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-68366 being exploited?
There is no known exploitation of CVE-2026-68366 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68366, DEBIAN-CVE-2026-68366, GHSA-hxh7-878r-vrmm, UBUNTU-CVE-2026-68366.