CVE-2026-23312: net: usb: kaweth: validate USB endpoints
In the Linux kernel, the following vulnerability has been resolved:
net: usb: kaweth: validate USB endpoints
The kaweth driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Linux kernel with the kaweth USB network driver are exposed when they probe a malicious USB device. Exploitation requires local access and low privileges.
What does an attacker need to do to trigger the flaw?
An attacker needs to present a malicious USB device whose endpoint layout does not match what the kaweth driver expects. The driver can later crash when it accesses the missing or incorrect endpoints.
What is the impact of successful exploitation?
Successful exploitation can cause a denial of service through a kernel crash. The provided severity vector indicates no confidentiality or integrity impact.
What should be done if patching cannot happen immediately?
Limit exposure to untrusted USB devices, particularly devices that could be handled by the kaweth driver. A patch is available.