Log in Start free

Vulnerability · Published Sep 21, 2026 · Assigned by redhat

CVE-2026-92382Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write

Medium 4.1

In plain English

A medium-severity out-of-bounds write in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)4.1Medium
Exploit odds (30 days)0.1%top 97.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhost_iso_packet() and allowing a usbredir peer to write past the end of the packet descriptor array on every subsequent isochronous packet.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12usbredirno fix listedDEBIAN-CVE-2026-92382
Debian:13usbredirno fix listedDEBIAN-CVE-2026-92382
Debian:14usbredirno fix listedDEBIAN-CVE-2026-92382
Ubuntu:22.04:LTSusbredirno fix listedUBUNTU-CVE-2026-92382
Ubuntu:24.04:LTSusbredirno fix listedUBUNTU-CVE-2026-92382
Ubuntu:26.04:LTSusbredirno fix listedUBUNTU-CVE-2026-92382
Ubuntu:26.10usbredirno fix listedUBUNTU-CVE-2026-92382

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

References