CVE-2026-92382— Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 usbredir 中发现了一个越界写入漏洞。若启动一个传输计数为 1 的同步 OUT 流，则该流的单个传输缓冲区将永久处于未提交状态，从而导致 usbredirhost_iso_packet() 中的边界检查失效。这使得 usbredir 对等端在后续每一个同步数据包中都能越过数据包描述符数组的末尾进行写入。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 5
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
unknown |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92382
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write
Source: CVE Program / CVE List V5
Vulnerability Description
An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhost_iso_packet() and allowing a usbredir peer to write past the end of the packet descriptor array on every subsequent isochronous packet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/a:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:rhel_els:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:rhel_els:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/a:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/a:redhat:enterprise_linux:9
|
|
II. Public POCs for CVE-2026-92382
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92382
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-92382 (1)
Same Patch Batch · Red Hat · 2026-09-21 · 12 CVEs total
| CVE-2026-80110 | 8.1 HIGH | Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent |
| CVE-2026-15801 | 8.0 HIGH | Cri-o: cri-o: insufficient validation during container checkpoint restore |
| CVE-2026-94449 | 7.5 HIGH | Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyg |
| CVE-2026-75939 | 7.4 HIGH | Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before |
| CVE-2026-94368 | 7.1 HIGH | Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-co |
| CVE-2026-94215 | 5.5 MEDIUM | Keycloak-services: keycloak-services: cross-realm client read/write via request-level cach |
| CVE-2026-93433 | 5.5 MEDIUM | Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd pa |
| CVE-2026-94184 | 5.3 MEDIUM | Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-202 |
| CVE-2026-94213 | 4.9 MEDIUM | Keycloak-services: keycloak-services: authorization services policy evaluation endpoint le |
| CVE-2026-94217 | 3.5 LOW | Keycloak-services: keycloak-services: uma scope merge across resource owners via resource |
| CVE-2026-94218 | 3.1 LOW | Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication sess |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-121885
Podman: untrusted image labels allow auto-update to restart -
CVE-2026-125709
Libstdc++: overflow leaves streambuf in inconsistent state o -
CVE-2026-125707
Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf de -
CVE-2026-125706
Gst-plugins-bad: gst-plugins-bad: missing bounds checks in m -
CVE-2026-125712
Gst-plugins-base: gst-plugins-base: missing bounds checks in
Same vendor: Red Hat
-
CVE-2026-121885
Podman: untrusted image labels allow auto-update to restart -
CVE-2026-120399
Flightctl-api: flightctl-remote-access: flightctl: unbounded -
CVE-2026-124747
Busybox: heap buffer overflow in wget ftp resume when the re -
CVE-2026-125709
Libstdc++: overflow leaves streambuf in inconsistent state o -
CVE-2026-125707
Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf de
Same weakness: CWE-787
-
CVE-2026-66334
OFBD SMM Write Validation Issues -
CVE-2026-61547
rabbitmq-c: Heap Buffer Overflow in amqp_send_frame() When S -
CVE-2026-11316
dr_libs 0.14.5 dr_wav 越界写漏洞 -
CVE-2026-124747
Busybox: heap buffer overflow in wget ftp resume when the re -
CVE-2026-125742
7-Zip before 26.06 Heap Out-of-Bounds Write via LZX Decoder