Junglewise Threat Intelligence

CVE-2026-23365: Linux Kernel denial of service in Kalmia USB driver

CVE-2026-23365 · Severity: medium · CVSS 5.5 · Published 2026-03-25

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability exists in the Linux kernel's Kalmia USB driver, which is used to support certain Samsung network adapters. If a specially crafted, malicious USB device is plugged into a system, it can cause the operating system to crash. This could lead to a denial-of-service, impacting the availability of the affected machine or industrial controller.

Technical details

A vulnerability in the 'kalmia_bind' function within 'drivers/net/usb/kalmia.c' in the Linux kernel arises from insufficient validation of USB endpoints. The driver blindly accesses expected endpoints without verifying their existence or type during the device probing phase. An attacker with physical access could connect a malicious USB device that lacks the expected URBs (USB Request Blocks), triggering a NULL pointer dereference or similar memory corruption leading to a kernel panic (DoS). The issue has been addressed by implementing 'usb_check_bulk_endpoints' to validate the presence of required IN and OUT bulk endpoints before binding.

Affected products

  • Linux Linux Kernel d40261236e8e to current fixed versions
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-25: advisory: Initial publication of CVE-2026-23365
  • 2026-03-25: patched: Patches merged into various stable kernel branches
  • 2026-07-14: advisory: Siemens updated advisory regarding affected SIMATIC products

References

Related threats