In the Linux kernel, the following vulnerability has been resolved:

net: usb: catc: bound the RX packet length in catc rx done()

catc rx done() walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pkt len > urb->actual length, ignores the header offset and compares against the whole transfer rather than the bytes left from pkt start, so a crafted packet header makes skb copy to linear data() read past the buffer.

A length below ETH HLEN is also accepted, including zero, and eth type trans() then reads a MAC header from the uninitialised tailroom of a shorter skb. The is f5u011 branch takes its length straight from the transfer, so a zero-length URB reaches the same path.

Track the bytes remaining from the current packet, and reject a header that does not fit, a length past what is left, and a length below an Ethernet header.

A transfer shorter than an Ethernet header, including a zero-length one, previously became a runt skb passed to netif rx() and counted as received; it is now counted in rx length errors and ends the walk.