{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"d9dd87bc1d7e8476d29d68883542ec6198d385c6","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"5b39d3da15344b87ef54a0a04f65b52622747e99","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"63c4e55d0741cfaf00515e807cad9293445cd348","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ee57992c053a6d395e98ced2d4c9cc3b42d8c27a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"64b687f9694777754285d489abbefa3784bc78da","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"cbe00048b69d67c8a78293cb7681b4c9963b26c7","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"1e47d8228b8767c8ac722aedb388f70adeeda43d","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"faaddd811c5099f11a5f52e68a6b31a5898cda4f","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-68365","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: io_edgeport: cap received transmit credits\n\nThe interrupt-status packet reports transmit credits returned by the\ndevice. edge_interrupt_callback() adds the 16-bit value to txCredits\nwithout checking maxTxCredits.\n\nedge_write() uses txCredits minus the software FIFO count as the amount\nof data that fits. Since the FIFO is allocated with maxTxCredits bytes,\ntxCredits exceeding maxTxCredits can cause OOB write in ring buffer.\n\nCap accumulated credits at maxTxCredits. Conforming devices should never\nhit the cap.","epss":{"date":"2026-11-06","percentile":0.08105,"score":0.00184},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793985570680,"publishedAt":1786363422358,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/d9dd87bc1d7e8476d29d68883542ec6198d385c6"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/5b39d3da15344b87ef54a0a04f65b52622747e99"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/63c4e55d0741cfaf00515e807cad9293445cd348"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/ee57992c053a6d395e98ced2d4c9cc3b42d8c27a"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/64b687f9694777754285d489abbefa3784bc78da"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/cbe00048b69d67c8a78293cb7681b4c9963b26c7"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/1e47d8228b8767c8ac722aedb388f70adeeda43d"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/faaddd811c5099f11a5f52e68a6b31a5898cda4f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/1e47d8228b8767c8ac722aedb388f70adeeda43d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/5b39d3da15344b87ef54a0a04f65b52622747e99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/63c4e55d0741cfaf00515e807cad9293445cd348"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/64b687f9694777754285d489abbefa3784bc78da"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/cbe00048b69d67c8a78293cb7681b4c9963b26c7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/d9dd87bc1d7e8476d29d68883542ec6198d385c6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/ee57992c053a6d395e98ced2d4c9cc3b42d8c27a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/faaddd811c5099f11a5f52e68a6b31a5898cda4f"}],"remediation":[],"revision":"b4f3a9761de58b631f4041d48e1c2c37027c3e33dae0c28ef34ca805571e96c6","sources":[{"modifiedAt":1793984114547,"name":"CNA: Linux","retrievedAt":1793985982434,"url":"https://www.cve.org/CVERecord?id=CVE-2026-68365"},{"modifiedAt":1793985570680,"name":"NVD","retrievedAt":1793989638196,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68365"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793985993946,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-68365"}],"ssvc":{"assessedAt":1793983692644,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"USB: serial: io_edgeport: cap received transmit credits","updatedAt":1793989638196}