Answer in brief
CVE-2026-68366 records a Unknown severity vulnerability in usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 <4e116372b7a4f87df0dc0ed4b0ab5b0bb0cc5796 || >=a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 <662f6c6c6ff8a6c508e1646c09cae74e28f3cca6 || >=a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 <1f03658f3e9b2f8fd1d1003ba389a0390b49a350 || >=a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 <c8510fbbea09ef0170b56b14dc2b5890dc75be07 || >=a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 <b70dc75e85ba968b7b76eebfe5d63000080b875b | 4e116372b7a4f87df0dc0ed4b0ab5b0bb0cc5796, 662f6c6c6ff8a6c508e1646c09cae74e28f3cca6, 1f03658f3e9b2f8fd1d1003ba389a0390b49a350, c8510fbbea09ef0170b56b14dc2b5890dc75be07, b70dc75e85ba968b7b76eebfe5d63000080b875b |
| Linux/Linuxgeneric | 3.10 | Not reported |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer uvc_send_response() builds the UVC control response from a user-supplied struct uvc_request_data: req->length = min_t(unsigned int, uvc->event_length, data->length); ... memcpy(req->buf, data->data, req->length); req->length is clamped to uvc->event_length, which is taken from the host control request wLength (up to UVC_MAX_REQUEST_SIZE, 64), and to data->length, which comes from the UVCIOC_SEND_RESPONSE ioctl and is only checked for being negative. The source buffer data->data is only 60 bytes, so a response with uvc->event_length and data->length both greater than 60 makes memcpy() read past the end of data->data. Clamp req->length to sizeof(data->data) as well.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-68366 records a Unknown severity vulnerability in usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 <4e116372b7a4f87df0dc0ed4b0ab5b0bb0cc5796 || >=a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 <662f6c6c6ff8a6c508e1646c09cae74e28f3cca6 || >=a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 <1f03658f3e9b2f8fd1d1003ba389a0390b49a350 || >=a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 <c8510fbbea09ef0170b56b14dc2b5890dc75be07 || >=a5eaaa1f33e771fa1651a4a7652b8a5f9fa7f6c1 <b70dc75e85ba968b7b76eebfe5d63000080b875b | 4e116372b7a4f87df0dc0ed4b0ab5b0bb0cc5796, 662f6c6c6ff8a6c508e1646c09cae74e28f3cca6, 1f03658f3e9b2f8fd1d1003ba389a0390b49a350, c8510fbbea09ef0170b56b14dc2b5890dc75be07, b70dc75e85ba968b7b76eebfe5d63000080b875b |
| Linux/Linuxgeneric | 3.10 | Not reported |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer uvc_send_response() builds the UVC control response from a user-supplied struct uvc_request_data: req->length = min_t(unsigned int, uvc->event_length, data->length); ... memcpy(req->buf, data->data, req->length); req->length is clamped to uvc->event_length, which is taken from the host control request wLength (up to UVC_MAX_REQUEST_SIZE, 64), and to data->length, which comes from the UVCIOC_SEND_RESPONSE ioctl and is only checked for being negative. The source buffer data->data is only 60 bytes, so a response with uvc->event_length and data->length both greater than 60 makes memcpy() read past the end of data->data. Clamp req->length to sizeof(data->data) as well.
Quoted source text, attributed separately from HOL analysis.