Executive brief
A vulnerability in the Linux kernel's Kawasaki USB Ethernet driver could allow a system crash when a specially crafted or malicious USB device is plugged in. The driver fails to verify that the connected device has the expected communication channels before attempting to use them. This could be used by an attacker with physical access or local permissions to cause a denial-of-service by crashing the operating system.
Technical details
A vulnerability exists in the kaweth (Kawasaki USB Ethernet) driver within the Linux kernel due to insufficient validation of USB endpoints during the device probing phase. The driver blindly accesses USB Request Blocks (URBs) without verifying that the device provides the expected number and types of bulk and interrupt endpoints. An attacker can exploit this by presenting a malicious USB device that lacks these endpoints, leading to a null pointer dereference or similar memory corruption that crashes the kernel. The fix introduces calls to usb_check_bulk_endpoints and usb_check_int_endpoints to ensure the device meets the driver's requirements before binding.
Affected products
- Linux Linux Kernel 2.6.12.1 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7
Timeline
- 2026-03-25: disclosed
- 2026-03-25: advisory
- 2026-02-25: patched: Initial patch committed to mainline kernel.
References
- https://git.kernel.org/stable/c/0aae18e4638a7c1c579df92bc6edc36cedfaaa8c
- https://git.kernel.org/stable/c/2795fc06e7652c0ba299d936c584d5e08b6b57a1
- https://git.kernel.org/stable/c/3b5075e4ce97d1a1ce82ff3fb6308761987a48bb
- https://git.kernel.org/stable/c/4b063c002ca759d1b299988ee23f564c9609c875
- https://git.kernel.org/stable/c/6c986abd2a5033633c6e6f9dd135cf96b19c7fdf
- https://git.kernel.org/stable/c/72f90f481c6a059680b9b976695d4cfb04fba1f3
- https://git.kernel.org/stable/c/7c7ebf5e45d2504d92ea294ac3828d58586491df