CVE-2026-43156: net: usb: pegasus: enable basic endpoint checking
In the Linux kernel, the following vulnerability has been resolved:
net: usb: pegasus: enable basic endpoint checking
pegasusprobe() fills URBs with hardcoded endpoint pipes without verifying the endpoint descriptors:
- usbrcvbulkpipe(dev, 1) for RX data - usbsndbulkpipe(dev, 2) for TX data - usbrcvintpipe(dev, 3) for status interrupts
A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes.
Add a pegasususbep enum for endpoint numbers, replacing magic constants throughout. Add usbcheckbulkendpoints() and usbcheckintendpoints() calls before any resource allocation to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time, and avoid triggering assertion.
Similar fix to - commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking") - commit 9e7021d2aeae ("net: usb: catc: enable basic endpoint checking")
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43156?
CVE-2026-43156 has a medium severity rating of 5.5 according to the CVSS 3.1 system.
How do I fix CVE-2026-43156?
To resolve CVE-2026-43156, users should apply the available patch from the Linux kernel.
What software is affected by CVE-2026-43156?
CVE-2026-43156 affects the Linux kernel, specifically the pegasus driver.
What is the impact of CVE-2026-43156?
The vulnerability allows for the use of hardcoded endpoint pipes without verifying endpoint descriptors, leading to potential denial of service.
When was CVE-2026-43156 published?
CVE-2026-43156 was published on May 6, 2026.