{"id":"CVE-2026-23290","title":"net: usb: pegasus: validate USB endpoints","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: validate USB endpoints\n\nThe pegasus driver should validate that the device it is probing has the\nproper number and types of USB endpoints it is expec…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d5d9086211877361f1bda44a0aec538ddb04042a","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < af7369ae572f53cb701731a4289ec3b3889bc501","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 43d7c4114b1ec14f41f09306525d3b9382286fc1","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7f8505c7ce3f186ef9d2495f3c0bd6ad6fce999f","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 95556b4e879711693c9865ba0938c148f62d5ea4","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c3f1672eaea68c5cb6e1ec081cdb92045453218f","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ee31ec8cf1eafeefa85ef934ba688d27f88bf0e2","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 11de1d3ae5565ed22ef1f89d73d8f2d00322c699","Linux 2.6.12"],"published":"2026-03-25","updated":"2026-09-08","sourceUpdated":"2026-09-08T08:45:24.154Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23290","references":[{"url":"https://git.kernel.org/stable/c/d5d9086211877361f1bda44a0aec538ddb04042a"},{"url":"https://git.kernel.org/stable/c/af7369ae572f53cb701731a4289ec3b3889bc501"},{"url":"https://git.kernel.org/stable/c/43d7c4114b1ec14f41f09306525d3b9382286fc1"},{"url":"https://git.kernel.org/stable/c/7f8505c7ce3f186ef9d2495f3c0bd6ad6fce999f"},{"url":"https://git.kernel.org/stable/c/95556b4e879711693c9865ba0938c148f62d5ea4"},{"url":"https://git.kernel.org/stable/c/c3f1672eaea68c5cb6e1ec081cdb92045453218f"},{"url":"https://git.kernel.org/stable/c/ee31ec8cf1eafeefa85ef934ba688d27f88bf0e2"},{"url":"https://git.kernel.org/stable/c/11de1d3ae5565ed22ef1f89d73d8f2d00322c699"}],"tags":["cve.org"],"epss":0.00129,"epssPercentile":0.02886,"ingestedAt":"2026-09-08T15:33:26.993Z","slug":"CVE-2026-23290","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: validate USB endpoints\n\nThe pegasus driver should validate that the device it is probing has the\nproper number and types of USB endpoints it is expecting before it binds\nto it.  If a malicious device were to not have the same urbs the driver\nwill crash later on when it blindly accesses these endpoints.\n\n## Affected\n\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d5d9086211877361f1bda44a0aec538ddb04042a`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < af7369ae572f53cb701731a4289ec3b3889bc501`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 43d7c4114b1ec14f41f09306525d3b9382286fc1`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7f8505c7ce3f186ef9d2495f3c0bd6ad6fce999f`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 95556b4e879711693c9865ba0938c148f62d5ea4`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c3f1672eaea68c5cb6e1ec081cdb92045453218f`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ee31ec8cf1eafeefa85ef934ba688d27f88bf0e2`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 11de1d3ae5565ed22ef1f89d73d8f2d00322c699`\n- `Linux 2.6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}