Improper input validation in Linux kernel - CVE-2026-45923
Published: May 28, 2026
Vulnerability identifier: #VU132568
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-45923
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows an attacker with physical access to cause a denial of service.
The vulnerability exists due to improper input validation in the catc USB network driver when probing a malformed USB device with mismatched endpoint descriptors. An attacker with physical access can connect a specially crafted USB device to cause a denial of service.
The issue occurs because the driver assumes specific bulk and interrupt endpoint types for hardcoded endpoint numbers during device initialization.
How to mitigate CVE-2026-45923
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/163d04897e57633c5d2e69734e4e4b22bb63f50d
- https://git.kernel.org/stable/c/1a42cfced8900d33d032c7ec338484855b61b8cc
- https://git.kernel.org/stable/c/36c28b028efba0f42218d41fed12c47ce217c1f1
- https://git.kernel.org/stable/c/9e7021d2aeae57c323a6f722ed7915686cdcc123
- https://git.kernel.org/stable/c/a488001a8197da4f9c413eec8f6acbff71c60145
- https://git.kernel.org/stable/c/ac7739b78ded519e1d9919a814da3b34120bec8c
- https://git.kernel.org/stable/c/eade522d3e6ac3f3bfb51bfa5b5b4b32bd0b846f