CVE-2026-23365: net: usb: kalmia: validate USB endpoints
In the Linux kernel, the following vulnerability has been resolved:
net: usb: kalmia: validate USB endpoints
The kalmia driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.130.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems that use the Linux kernel kalmia USB driver and can be connected to a malicious or malformed USB device are exposed. The listed affected software includes the Linux kernel and Microsoft azl3 kernel 6.6.126.1-1.
What does an attacker need to exploit the vulnerability?
An attacker needs local access sufficient to present a malicious USB device to the system. The device must lack the endpoint layout the kalmia driver expects, causing the driver to access endpoints without prior validation.
What is the likely impact of successful exploitation?
The driver can crash when it later accesses missing or unexpected USB endpoints. The provided vector indicates an availability impact only, with no stated confidentiality or integrity impact.