CVE-2026-68366

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the uvc send response() function where the system builds a UVC control response using a user-supplied uvc request data structure. The req->length variable is clamped to uvc->event length (derived from the host control request wLength) and data->length (provided via the UVCIOC SEND RESPONSE ioctl). Because the source buffer data->data is only 60 bytes, if both uvc->event length and data->length exceed 60, the memcpy() function reads beyond the end of the data->data buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.