CVE-2026-45923: net: usb: catc: enable basic endpoint checking
In the Linux kernel, the following vulnerability has been resolved:
net: usb: catc: enable basic endpoint checking
catcprobe() fills three URBs with hardcoded endpoint pipes without verifying the endpoint descriptors:
- usbsndbulkpipe(usbdev, 1) and usbrcvbulkpipe(usbdev, 1) for TX/RX - usbrcvintpipe(usbdev, 2) for interrupt status
A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes.
Add a catcusbep enum for endpoint numbers, replacing magic constants throughout. Add usbcheckbulkendpoints() and usbcheckintendpoints() calls after usbsetinterface() to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time.
Similar to - commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking") which fixed the issue in rtl8150.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux kernel (net: usb: rtl8150)to a version that resolves this vulnerability.Patch 90b7f2961798
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs local access and the ability to present a malformed USB device to a system using the affected CATC USB network driver. No user interaction is required, but the CVSS vector indicates low privileges are required.
What conditions make a system exposed?
Exposure requires the Linux kernel CATC USB network driver to probe a USB device whose endpoint descriptors use types different from those assumed by the driver. The vulnerable behavior occurs during device probing, before the fix rejects mismatched bulk and interrupt endpoints.
What is the impact of successful exploitation?
Successful exploitation can cause a denial of service through high impact to availability. The provided CVSS assessment indicates no confidentiality or integrity impact.
What can be done if an update cannot be applied immediately?
Avoid connecting untrusted USB devices that could be handled by the CATC USB network driver. The data does not provide another configuration-based mitigation.