In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SENDRESPONSE length to the response buffer uvcsendresponse() builds the UVC control response from a user-supplied struct uvcrequestdata: req->length = mint(unsigned int, uvc->eventlength, data->length); ... memcpy(req->buf, data->data, req->length); req->length is clamped to uvc->eventlength, which is taken from the host control request wLength (up to UVCMAXREQUESTSIZE, 64), and to data->length, which comes from the UVCIOCSENDRESPONSE ioctl and is only checked for being negative. The source buffer data->data is only 60 bytes, so a response with uvc->eventlength and data->length both greater than 60 makes memcpy() read past the end of data->data. Clamp req->length to sizeof(data->data) as well.