{"id":"CVE-2026-23365","title":"net: usb: kalmia: validate USB endpoints","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: kalmia: validate USB endpoints\n\nThe kalmia driver should validate that the device it is probing has the\nproper number and types of USB endpoints it is expecti…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= d40261236e8e278cb1936cb5e934262971692b10 < ff675bc5b3e8c356f9d993d65d0bae6ed0dc7459","Linux >= d40261236e8e278cb1936cb5e934262971692b10 < 185050b47df3d41e49f20ad01beea2e7b9cddaa7","Linux >= d40261236e8e278cb1936cb5e934262971692b10 < 28a380bfa5bc7f6a9380b85e8eab919ee6ac1701","Linux >= d40261236e8e278cb1936cb5e934262971692b10 < 12c0243de0aee0ab27cc00932fd5edae65c1e3a2","Linux >= d40261236e8e278cb1936cb5e934262971692b10 < 51c20ea5f1555a984c041b0dbf56f00d41b9e652","Linux >= d40261236e8e278cb1936cb5e934262971692b10 < 011684cd18349aa4c52167c8ac37a0524169f48c","Linux >= d40261236e8e278cb1936cb5e934262971692b10 < 7bfda1a0be4caec3263753d567678451cef73a85","Linux >= d40261236e8e278cb1936cb5e934262971692b10 < c58b6c29a4c9b8125e8ad3bca0637e00b71e2693","Linux 3.0"],"published":"2026-03-25","updated":"2026-09-08","sourceUpdated":"2026-09-08T08:45:45.432Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23365","references":[{"url":"https://git.kernel.org/stable/c/ff675bc5b3e8c356f9d993d65d0bae6ed0dc7459"},{"url":"https://git.kernel.org/stable/c/185050b47df3d41e49f20ad01beea2e7b9cddaa7"},{"url":"https://git.kernel.org/stable/c/28a380bfa5bc7f6a9380b85e8eab919ee6ac1701"},{"url":"https://git.kernel.org/stable/c/12c0243de0aee0ab27cc00932fd5edae65c1e3a2"},{"url":"https://git.kernel.org/stable/c/51c20ea5f1555a984c041b0dbf56f00d41b9e652"},{"url":"https://git.kernel.org/stable/c/011684cd18349aa4c52167c8ac37a0524169f48c"},{"url":"https://git.kernel.org/stable/c/7bfda1a0be4caec3263753d567678451cef73a85"},{"url":"https://git.kernel.org/stable/c/c58b6c29a4c9b8125e8ad3bca0637e00b71e2693"}],"tags":["cve.org"],"epss":0.00129,"epssPercentile":0.02086,"ingestedAt":"2026-09-08T15:33:26.992Z","slug":"CVE-2026-23365","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: kalmia: validate USB endpoints\n\nThe kalmia driver should validate that the device it is probing has the\nproper number and types of USB endpoints it is expecting before it binds\nto it.  If a malicious device were to not have the same urbs the driver\nwill crash later on when it blindly accesses these endpoints.\n\n## Affected\n\n- `Linux >= d40261236e8e278cb1936cb5e934262971692b10 < ff675bc5b3e8c356f9d993d65d0bae6ed0dc7459`\n- `Linux >= d40261236e8e278cb1936cb5e934262971692b10 < 185050b47df3d41e49f20ad01beea2e7b9cddaa7`\n- `Linux >= d40261236e8e278cb1936cb5e934262971692b10 < 28a380bfa5bc7f6a9380b85e8eab919ee6ac1701`\n- `Linux >= d40261236e8e278cb1936cb5e934262971692b10 < 12c0243de0aee0ab27cc00932fd5edae65c1e3a2`\n- `Linux >= d40261236e8e278cb1936cb5e934262971692b10 < 51c20ea5f1555a984c041b0dbf56f00d41b9e652`\n- `Linux >= d40261236e8e278cb1936cb5e934262971692b10 < 011684cd18349aa4c52167c8ac37a0524169f48c`\n- `Linux >= d40261236e8e278cb1936cb5e934262971692b10 < 7bfda1a0be4caec3263753d567678451cef73a85`\n- `Linux >= d40261236e8e278cb1936cb5e934262971692b10 < c58b6c29a4c9b8125e8ad3bca0637e00b71e2693`\n- `Linux 3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}