CVE-2026-92382: usbredir Buffer Overflow Vulnerability

CVE-2026-92382 Overview

CVE-2026-92382 is an out-of-bounds write vulnerability [CWE-787] in usbredir, a protocol and library for redirecting USB traffic over a network. The flaw resides in the usbredirhost_iso_packet() function. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted. This condition defeats the bounds check in the function, allowing a usbredir peer to write past the end of the packet descriptor array on every subsequent isochronous packet. Exploitation requires local access and high privileges, and impacts only availability.

Critical Impact
A malicious usbredir peer can trigger repeated out-of-bounds writes in the host process, corrupting adjacent memory and crashing the process that handles USB redirection.

Affected Products

usbredir library and usbredirhost component
Red Hat distributions and downstream products bundling usbredir (see Red Hat advisory)
Virtualization stacks that use usbredir for USB passthrough over the network

Discovery Timeline

2026-09-21 - CVE-2026-92382 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-92382

Vulnerability Analysis

The usbredir project brokers USB traffic between a guest and a physical device by exchanging packets over a socket. usbredirhost submits libusb transfers on behalf of the remote peer, including isochronous OUT streams used by real-time devices such as audio or video peripherals.

When an isochronous OUT stream starts with a transfer count of 1, the single transfer buffer is never marked as submitted. The bounds check inside usbredirhost_iso_packet() relies on submitted state to gate writes into the packet descriptor array. Because the check is defeated, each subsequent isochronous packet writes one entry past the end of the descriptor array. The result is deterministic memory corruption in the usbredirhost process on every packet the peer sends.

Root Cause

The root cause is a state-tracking error combined with an insufficient bounds check. The single-transfer edge case never transitions the buffer into a submitted state, so the guard that should prevent writes beyond the descriptor array evaluates against stale state. This is a classic out-of-bounds write [CWE-787] driven by attacker-controlled stream setup parameters.

Attack Vector

Exploitation requires a local usbredir peer with sufficient privileges to negotiate an isochronous OUT stream against usbredirhost. The attacker starts the stream with a transfer count of 1, then sends isochronous packets to trigger repeated out-of-bounds writes. The consistent impact is a denial of service against the host process; confidentiality and integrity are not directly impacted according to the CVSS vector.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability at publication is 0.136%.

The vulnerability manifests in usbredirhost_iso_packet() when handling isochronous OUT streams with a transfer count of 1. See the Red Hat CVE-2026-92382 Advisory and Red Hat Bug Report #2535972 for upstream details.

Detection Methods for CVE-2026-92382

Indicators of Compromise

Unexpected crashes or SIGSEGV terminations of processes linking usbredirhost, including QEMU or SPICE-based virtualization daemons
Coredumps whose stack traces include usbredirhost_iso_packet frames
usbredir sessions that negotiate isochronous OUT streams with a transfer count of 1 followed by a burst of isochronous packets

Detection Strategies

Enable coredump collection on hosts running usbredirhost and alert on crashes originating from usbredir symbols
Instrument affected binaries with AddressSanitizer or run under Valgrind in test environments to surface the out-of-bounds write during fuzzing
Correlate hypervisor process crashes with active USB redirection sessions from untrusted or guest-controlled peers

Monitoring Recommendations

Monitor systemd journal and /var/log/messages for repeated usbredir process termination events
Track guest-to-host USB redirection channels for anomalously short-lived sessions that trigger host-side faults
Audit which local accounts are permitted to initiate usbredir connections against production virtualization hosts

How to Mitigate CVE-2026-92382

Immediate Actions Required

Apply vendor updates for usbredir as soon as fixed packages are published by your Linux distribution
Restrict which local users and guest workloads can open usbredir sessions against usbredirhost
Disable USB redirection for untrusted guests until patched packages are deployed

Patch Information

Refer to the Red Hat CVE-2026-92382 Advisory for the authoritative list of affected packages, fixed versions, and errata. Downstream distributions consuming usbredir should publish rebuilt packages that fix the transfer-count-of-1 edge case in usbredirhost_iso_packet(). Track the Red Hat Bug Report #2535972 for upstream patch progress.

Workarounds

Configure virtualization stacks such as QEMU and SPICE to disable USB redirection where it is not required
Limit usbredirhost exposure to trusted local peers only, using UNIX socket permissions or SELinux policy
Restart affected services after any observed usbredir crash to restore USB redirection functionality

bash

# Example: disable SPICE USB redirection channels in a libvirt domain
# Edit the guest XML and remove or comment out <redirdev> entries:
#   <redirdev bus='usb' type='spicevmc'/>
# Then define and restart the domain:
virsh define /etc/libvirt/qemu/<guest>.xml
virsh destroy <guest>
virsh start <guest>