CVE-2026-68366 Overview
CVE-2026-68366 is an out-of-bounds read vulnerability in the Linux kernel's USB gadget UVC (USB Video Class) driver. The flaw resides in the uvc_send_response() function within the usb: gadget: uvc subsystem. The function builds a UVC control response using a user-supplied struct uvc_request_data without properly clamping the response length to the source buffer size. When both uvc->event_length and data->length exceed 60 bytes, memcpy() reads past the end of the 60-byte data->data source buffer.
Critical Impact
Local users with access to the UVC gadget UVCIOC_SEND_RESPONSE ioctl can trigger a kernel out-of-bounds read, potentially disclosing adjacent kernel memory contents to a USB host.
Affected Products
- Linux kernel versions containing the vulnerable uvc_send_response() implementation in drivers/usb/gadget/function/uvc_v4l2.c
- Systems configured as USB UVC gadgets exposing the /dev/video* control interface via configfs
- Distributions shipping kernels prior to the upstream fix commits referenced in the stable tree
Discovery Timeline
- 2026-08-10 - CVE-2026-68366 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68366
Vulnerability Analysis
The vulnerability exists in uvc_send_response(), which prepares a USB control response for delivery back to a USB host. The function computes the response length as req->length = min_t(unsigned int, uvc->event_length, data->length); and then copies bytes with memcpy(req->buf, data->data, req->length);.
Both inputs to the min_t() clamp are attacker-influenced. The uvc->event_length value is derived from the host control request's wLength field, bounded only by UVC_MAX_REQUEST_SIZE (64). The data->length value is supplied through the UVCIOC_SEND_RESPONSE ioctl and is only validated to reject negative values. Neither input is compared against the actual size of the source buffer data->data, which is 60 bytes.
When both lengths reach values above 60 (up to 64), memcpy() reads 1 to 4 bytes past the end of data->data. Those bytes are then transmitted over the USB control endpoint, leaking adjacent kernel memory to the USB host. This condition is classified as an out-of-bounds read [CWE-125].
Root Cause
The root cause is missing validation of the copy length against the fixed size of the source buffer. The code trusts two length fields, one from the USB host and one from a local ioctl caller, without cross-checking either against sizeof(data->data). The upstream fix adds a third clamp so that req->length never exceeds sizeof(data->data).
Attack Vector
Exploitation requires local privileges sufficient to open the UVC gadget control device and issue UVCIOC_SEND_RESPONSE with a crafted struct uvc_request_data. A USB host connected to the gadget must also send a UVC class control request with a large wLength. The leaked bytes appear in the USB control transfer response, giving the USB host visibility into up to four bytes of kernel slab memory adjacent to the ioctl buffer.
The vulnerability is described in prose only; see the Linux Kernel Commit for the patch that clamps req->length to sizeof(data->data).
Detection Methods for CVE-2026-68366
Indicators of Compromise
- Unexpected USB gadget configuration on production systems, particularly configfs entries under /sys/kernel/config/usb_gadget/*/functions/uvc.*
- Userspace processes issuing UVCIOC_SEND_RESPONSE ioctls with data.length values greater than 60
- USB host-side captures showing UVC class control responses with wLength above 60 originating from a Linux gadget
Detection Strategies
- Audit kernel versions across the fleet and compare against the fixed commits listed in the stable tree references
- Enable KASAN (Kernel Address Sanitizer) in test environments to surface the out-of-bounds read at runtime
- Instrument uvc_v4l2.c with tracepoints or eBPF probes on uvc_send_response to log event_length and data->length pairs
Monitoring Recommendations
- Track ioctl() calls against /dev/video* nodes attached to gadget UVC functions and alert on abnormally large data.length arguments
- Correlate USB gadget instantiation events with process ancestry to identify unauthorized gadget setup
- Ingest kernel logs into the Singularity Data Lake and hunt for KASAN slab-out-of-bounds reports mentioning uvc_send_response
How to Mitigate CVE-2026-68366
Immediate Actions Required
- Apply the upstream stable-tree patches that clamp req->length to sizeof(data->data) in uvc_send_response()
- Rebuild and redeploy kernels from distributions once vendor updates incorporating the fix are available
- Restrict access to UVC gadget control device nodes to trusted service accounts only
Patch Information
The fix is committed to the mainline and stable Linux kernel trees. Reference commits include 1f03658f3e9b, 4e116372b7a4, 662f6c6c6ff8, b70dc75e85ba, and c8510fbbea09. The patch adds sizeof(data->data) as an additional argument to the min_t() clamp so that memcpy() cannot read past the source buffer.
Workarounds
- Disable the CONFIG_USB_CONFIGFS_F_UVC kernel option on systems that do not require UVC gadget functionality
- Unload the usb_f_uvc module and prevent it from being auto-loaded via a modprobe blacklist entry
- Enforce mandatory access control policies (SELinux, AppArmor) to deny non-root processes access to UVC gadget device nodes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
