CVE-2016-20022
linux: In the Linux kernel before 4.8, usb_parse_endpoint in drivers/usb/core/config.c does not validate the wMaxPacketSize...
CVE-2016-20022 is fixed in linux on 1 platform, first by DEBIAN-CVE-2016-20022, released June 27, 2024. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
8.4
high
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0024
14th percentile
In the Linux kernel before 4.8, usb_parse_endpoint in drivers/usb/core/config.c does not validate the wMaxPacketSize field of an endpoint descriptor. NOTE: This vulnerability only affects products that are no longer supported by the supplier.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| linux · Debian 12.15 (bookworm) | 4.7.4-1 | DEBIAN-CVE-2016-20022 | Jun 27, 2024 |
| linux · Debian 13.5 (trixie) | 4.7.4-1 | DEBIAN-CVE-2016-20022 | Jun 27, 2024 |
| linux · Debian 14 | 4.7.4-1 | DEBIAN-CVE-2016-20022 | Jun 27, 2024 |