CVE-2026-23290: net: usb: pegasus: validate USB endpoints
In the Linux kernel, the following vulnerability has been resolved:
net: usb: pegasus: validate USB endpoints
The pegasus driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23290?
CVE-2026-23290 has a severity rating of medium with a score of 5.5.
How do I fix CVE-2026-23290?
To mitigate CVE-2026-23290, ensure that you are using a patched version of the Linux kernel that addresses the USB endpoint validation in the pegasus driver.
What are the potential impacts of CVE-2026-23290?
If exploited, CVE-2026-23290 could allow a malicious USB device to bind to the system incorrectly, potentially leading to unauthorized access or system compromise.
Which software is affected by CVE-2026-23290?
CVE-2026-23290 affects the Linux kernel, specifically the pegasus driver, and may also impact Microsoft’s azl3 kernel version 6.6.126.1-1.
Is CVE-2026-23290 exploitable remotely?
CVE-2026-23290 is not considered to be exploitable remotely as it requires a malicious USB device to connect to the system.