Improper input validation in Linux kernel - CVE-2026-43156
Published: May 7, 2026
Vulnerability identifier: #VU130578
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-43156
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows an attacker with physical access to cause a denial of service.
The vulnerability exists due to improper input validation in pegasus_probe() when probing a malformed USB device with mismatched endpoint descriptors. An attacker with physical access can connect a specially crafted USB device to cause a denial of service.
The issue is triggered because the driver assumes fixed endpoint numbers and transfer types for RX, TX, and status interrupt URBs.
How to mitigate CVE-2026-43156
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/229dc9b9db475ac900182bafe258943e0e054c6d
- https://git.kernel.org/stable/c/26b3ec62fa1a94ac801feca47f040fc729b3c174
- https://git.kernel.org/stable/c/2705709f6574a088aab246af72fc95f2fea51484
- https://git.kernel.org/stable/c/35854ed5c40b02f95824e44398f9d2ba33727203
- https://git.kernel.org/stable/c/3d7e6ce34f4fcc7083510c28b17a7c36462a25d4
- https://git.kernel.org/stable/c/67ba6b13dbcaf45681fb6758794c5ac5fa589a6c
- https://git.kernel.org/stable/c/a3e64e950a3981a8199de9798f6d21261b959171
- https://git.kernel.org/stable/c/d2e7c898cc02dfe42443489a67a45ed616cb76e9