Junglewise Threat Intelligence

CVE-2026-43156: Linux Kernel denial of service in Pegasus USB Ethernet driver

CVE-2026-43156 · Severity: medium · CVSS 5.5 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Pegasus USB Ethernet driver could allow a system crash when a specially crafted or 'malformed' USB device is plugged into the computer. The driver fails to verify that the device's communication channels match what it expects, leading to internal errors. This issue primarily impacts system availability, as an attacker with physical access could cause the machine to stop functioning.

Technical details

The vulnerability exists in the pegasus_probe() function within drivers/net/usb/pegasus.c. The driver fills USB Request Blocks (URBs) using hardcoded endpoint pipe values (bulk and interrupt) without first verifying the endpoint descriptors provided by the hardware. A malformed USB device can present endpoints with transfer types that differ from the driver's assumptions, potentially triggering kernel assertions or null pointer dereferences. The fix introduces mandatory endpoint checking using usb_check_bulk_endpoints() and usb_check_int_endpoints() during the probe phase to reject incompatible devices.

Affected products

  • Linux Linux Kernel versions from 2.6.12.1 up to (excluding) 5.10.252; 5.11 up to (excluding) 5.15.202; 5.16 up to (excluding) 6.1.165; 6.2 up to (excluding) 6.6.128; 6.7 up to (excluding) 6.12.75; 6.13 up to (excluding) 6.18.16; 6.19 up to (excluding) 6.19.6

Timeline

  • 2026-05-06: disclosed
  • 2026-05-06: advisory

References

Related threats