CVE-2026-98612: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-xhrr-qp73-mj8c
Share
Published
Advisory Summary

CVE-2026-98612 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98612 at a Glance

CVE Identifier CVE-2026-98612
GHSA Identifier GHSA-xhrr-qp73-mj8c
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98612

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98612, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catc_rx_done() catc_rx_done() walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pkt_len > urb->actual_length, ignores the header offset and compares against the whole transfer rather than the bytes left from pkt_start, so a crafted packet header makes skb_copy_to_linear_data() read past the buffer. A length below ETH_HLEN is also accepted, including zero, and eth_type_trans() then reads a MAC header from the uninitialised tailroom of a shorter skb. The is_f5u011 branch takes its length straight from the transfer, so a zero-length URB reaches the same path. Track the bytes remaining from the current packet, and reject a header that does not fit, a length past what is left, and a length below an Ethernet header. A transfer shorter than an Ethernet header, including a zero-length one, previously became a runt skb passed to netif_rx() and counted as received; it is now counted in rx_length_errors and ends the walk.

References

NVD — CVE-2026-98612 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98612
git.kernel.org/stable/c/21e206dd88... WEB
https://git.kernel.org/stable/c/21e206dd88b3de6e36bb607dec3797c59bc3007b
git.kernel.org/stable/c/2f87bbd5a7... WEB
https://git.kernel.org/stable/c/2f87bbd5a7bf6ee79d598f7e22cf77810d29ae87
git.kernel.org/stable/c/3942557938... WEB
https://git.kernel.org/stable/c/3942557938f846e7481f6ccb2b41ccbdee61baa1
git.kernel.org/stable/c/4cc0a8eb2f... WEB
https://git.kernel.org/stable/c/4cc0a8eb2f9336cfa3e4ac329bc5585ca970ced3
git.kernel.org/stable/c/801e21cf7d... WEB
https://git.kernel.org/stable/c/801e21cf7dd6bcee31db907625d5045f21c9c1d9
git.kernel.org/stable/c/9d4be026bd... WEB
https://git.kernel.org/stable/c/9d4be026bdff2c1da7b6c7e01c0a47f2df409e97
git.kernel.org/stable/c/9d565b6b72... WEB
https://git.kernel.org/stable/c/9d565b6b72fe3f41fd43636e143072848105189f
git.kernel.org/stable/c/dd9c6f8f05... WEB
https://git.kernel.org/stable/c/dd9c6f8f05170223edec2dac476606cd40d9acb7

Frequently Asked Questions

What is CVE-2026-98612?
CVE-2026-98612 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98612?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98612?
CVE-2026-98612 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98612?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xhrr-qp73-mj8c",
  "modified" : "2026-10-18T18:31:56Z",
  "published" : "2026-10-18T18:31:56Z",
  "aliases" : [ "CVE-2026-98612" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: catc: bound the RX packet length in catc_rx_done()\n\ncatc_rx_done() walks a multi-packet URB, reading a two-byte length from\neach packet header. Its bound, pkt_len > urb->actual_length, ignores the\nheader offset and compares against the whole transfer rather than the\nbytes left from pkt_start, so a crafted packet header makes\nskb_copy_to_linear_data() read past the buffer.\n\nA length below ETH_HLEN is also accepted, including zero, and\neth_type_trans() then reads a MAC header from the uninitialised tailroom\nof a shorter skb. The is_f5u011 branch takes its length straight from\nthe transfer, so a zero-length URB reaches the same path.\n\nTrack the bytes remaining from the current packet, and reject a header\nthat does not fit, a length past what is left, and a length below an\nEthernet header.\n\nA transfer shorter than an Ethernet header, including a zero-length one,\npreviously became a runt skb passed to netif_rx() and counted as\nreceived; it is now counted in rx_length_errors and ends the walk.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98612"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/21e206dd88b3de6e36bb607dec3797c59bc3007b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2f87bbd5a7bf6ee79d598f7e22cf77810d29ae87"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3942557938f846e7481f6ccb2b41ccbdee61baa1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4cc0a8eb2f9336cfa3e4ac329bc5585ca970ced3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/801e21cf7dd6bcee31db907625d5045f21c9c1d9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9d4be026bdff2c1da7b6c7e01c0a47f2df409e97"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9d565b6b72fe3f41fd43636e143072848105189f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/dd9c6f8f05170223edec2dac476606cd40d9acb7"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-18T16:17:14Z"
  }
}