CVE-2026-98597: Linux Kernel SR9700 Buffer Overflow Vulnerability

CVE-2026-98597 Overview

CVE-2026-98597 affects the Linux kernel sr9700 USB Ethernet driver. The receive fixup routine performs an incorrect length check that fails to account for receive overhead bytes. The driver subtracts the Ethernet CRC from the reported packet length but then compares that reduced payload length against the entire remaining receive buffer. Because the subsequent copy skips a three-byte header and the cursor advances past both the header and the four-byte CRC, the driver can read past the end of the buffer. The issue was discovered by a static-analysis tool and resolved upstream by requiring the payload to fit after SR_RX_OVERHEAD before copying or advancing to the next packet.

Critical Impact
A malformed USB Ethernet frame processed by the sr9700 driver can trigger an out-of-bounds read in kernel memory, potentially leading to kernel information disclosure or a denial-of-service condition.

Affected Products

Linux kernel versions containing the drivers/net/usb/sr9700.c driver prior to the fix
Systems using SR9700-based USB-to-Ethernet adapters
Multiple stable kernel branches referenced by the upstream backport commits

Discovery Timeline

2026-10-18 - CVE-2026-98597 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98597

Vulnerability Analysis

The sr9700 driver handles USB Ethernet adapters based on the CoreChips SR9700 chipset. During receive processing, sr9700_rx_fixup() iterates over packets contained within a single URB buffer. For each packet, the driver reads a length field from a three-byte header, then subtracts four bytes for the trailing Ethernet CRC to compute the payload length.

The flawed check compared the CRC-adjusted payload length against the remaining size of the receive buffer. However, the memory copy that follows begins after the three-byte header, and the cursor advance consumes the header plus the four-byte CRC. The length check therefore did not reserve space for the SR_RX_OVERHEAD bytes that the copy and advance actually consume. A crafted or malformed packet can cause the driver to copy or step beyond the valid buffer bounds.

Root Cause

The root cause is an off-by-overhead boundary error in sr9700_rx_fixup(). The length validation does not include the SR_RX_OVERHEAD bytes that are consumed in addition to the payload. This is an input validation error in boundary condition handling that can result in an out-of-bounds read of kernel memory adjacent to the receive buffer.

Attack Vector

Triggering the condition requires a malicious or malformed Ethernet frame to be delivered through an SR9700-based USB adapter and processed by the vulnerable driver. The attacker influence is scoped to data arriving on the USB Ethernet interface. There is no public exploit, and the EPSS probability for this issue is low.

No verified exploitation code is available. Technical details are documented in the upstream patch series; see the Linux Kernel Commit 92d88c8 and related stable backports for the exact buffer arithmetic change.

Detection Methods for CVE-2026-98597

Indicators of Compromise

Unexpected kernel oops, warnings, or KASAN out-of-bounds read reports originating in sr9700_rx_fixup or drivers/net/usb/sr9700.c
Repeated USB disconnect, reset, or link-flap events on SR9700 adapters correlated with network stack errors
Kernel log entries referencing malformed frames or truncated packets on the sr9700 interface

Detection Strategies

Inventory running kernels and loaded modules to identify hosts with the sr9700 driver active and unpatched
Monitor dmesg and journald for stack traces that reference sr9700 symbols or USB networking subsystems
Enable KASAN on test systems that use SR9700 hardware to surface out-of-bounds reads during fuzzing or regression testing

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on repeated sr9700 fault patterns
Track USB device enumeration events for SR9700 vendor and product IDs in sensitive environments
Review patch status of all Linux endpoints and servers against the fixed stable kernel versions

How to Mitigate CVE-2026-98597

Immediate Actions Required

Upgrade affected Linux kernels to a stable release that includes the sr9700 boundary-check fix
Where patching is deferred, physically disconnect SR9700-based USB Ethernet adapters from untrusted networks
Restrict physical and USB port access on systems that must retain SR9700 adapters

Patch Information

The fix enforces that the payload must fit within the remaining buffer after accounting for SR_RX_OVERHEAD before copying or advancing to the next packet. The change has been merged upstream and backported across multiple stable branches. Reference the patch series for the exact commits: 05b4427, 6ab6c9d, 8488779, 92d88c8, 9b59b00, baf07d5, c06bde8, and e1f5b74.

Workarounds

Blacklist the sr9700 kernel module on systems that do not require the driver
Use USB device filtering (for example, USBGuard) to deny SR9700 vendor and product IDs
Segment untrusted networks away from endpoints that rely on SR9700 USB Ethernet hardware

bash

# Blacklist the sr9700 driver until patched kernels are deployed
echo 'blacklist sr9700' | sudo tee /etc/modprobe.d/blacklist-sr9700.conf
sudo rmmod sr9700 2>/dev/null || true
sudo update-initramfs -u