CVE-2026-97540: net: usb: pegasus: don't rely on id table pointer arithmetic
In the Linux kernel, the following vulnerability has been resolved:
net: usb: pegasus: don't rely on id table pointer arithmetic
The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that is wildly out of bound. Instead of keeping a side table for additional information, use driverinfo field of the usbdeviceid.
The dynamic ID parsing code needs to be updated for this; convert it to just write to the reserved entry for dynamic ID and remove the weird loop.
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the faulty code path?
The issue occurs when a dynamic USB ID is involved. In that case, the probe callback receives a usb_device_id allocated on the heap, so pointer arithmetic against the driver's static ID table can calculate an out-of-bounds index.
Which systems are realistically exposed?
Systems using the Linux kernel Pegasus USB network driver are relevant, particularly where dynamic IDs are used with that driver. The provided information does not identify affected kernel versions or state whether dynamic IDs are enabled by default.
What indicates that a system may be affected?
A relevant indicator is use of the Pegasus USB networking driver together with a dynamically added USB device ID. The supplied data does not provide a crash signature, log message, or other runtime detection method.