CVE-2026-64351: net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
In the Linux kernel, the following vulnerability has been resolved:
net: usb: kalmia: bound RX frame length in kalmiarxfixup()
kalmiarxfixup() computes usbpacketlength = skb->len - (2 KALMIAHEADERLENGTH) as a u16, guarded only by a pre-loop check that skb->len is at least KALMIAHEADERLENGTH, which is 6. A device can deliver a short bulk-IN frame with skb->len in the 6 to 11 range, or leave a short trailing remainder on a later loop iteration. Either case underflows usbpacketlength to about 65530.
That bypasses the usbpacketlength < etherpacketlength truncation path. The device-supplied etherpacketlength, a le16 up to 65535 read from headerstart[2], then drives a memcmp() and the following skbtrim() and skbpull() past the end of the rx buffer. The rx buffer is hardmtu 10, which is 14000 bytes. That is an out of bounds read.
Require both the start and end framing headers to be present before subtracting them, on every loop iteration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1
Event History
Frequently Asked Questions
What is the vulnerability CVE-2026-64351 about?
CVE-2026-64351 involves a boundary issue in the Linux kernel's Kalmia USB driver that affects the handling of RX frame lengths.
What is the severity of CVE-2026-64351?
CVE-2026-64351 has a medium severity rating of 5.5.
How do I fix CVE-2026-64351?
To fix CVE-2026-64351, update your Linux kernel to the latest patched version provided by your distribution.
Which systems are affected by CVE-2026-64351?
CVE-2026-64351 affects the Linux kernel and specifically the Microsoft azl3 kernel version 6.6.144.1-1.
What impact does CVE-2026-64351 have?
CVE-2026-64351 can result in a denial of service due to improper handling of USB packet lengths.