Re: [PATCH net] net: usb: cx82310_eth: bound partial-frame remainder by current skb length

On Fri, Aug 14, 2026 at 09:08:14PM +0200, Jason Winter wrote:

When a frame straddles two bulk URBs, cx82310_rx_fixup() stores the
number of bytes still expected in dev->partial_rem and on the next call
memcpy()s that many bytes from the new skb without checking that the new
URB actually delivered that much data. A malicious device

So this is somewhat theoretical. Maybe less so than average, since
this is a USB dongle, but still, does it bother people?

Please drop the Fixes: tag and post for net-next.

https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html

    Andrew

---
pw-bot: cr