Junglewise Threat Intelligence

CVE-2026-45923: Linux Kernel CATC USB driver missing endpoint validation

CVE-2026-45923 · Severity: info · CVSS 0 · Published 2026-05-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's CATC USB network driver could allow a specially crafted, malicious USB device to cause system instability. The driver fails to verify that the hardware endpoints provided by a connected device match what the software expects. This could lead to unexpected behavior or system crashes when a malformed device is physically plugged into a computer.

Technical details

A vulnerability exists in the catc_probe() function of the drivers/net/usb/catc.c driver. The driver initializes three USB Request Blocks (URBs) using hardcoded endpoint addresses (endpoints 1 and 2) without first validating the endpoint descriptors provided by the hardware. A malicious or malformed USB device could present these endpoints with transfer types (e.g., bulk vs. interrupt) that differ from the driver's assumptions, leading to undefined behavior or kernel panics. The fix introduces explicit checks using usb_check_bulk_endpoints() and usb_check_int_endpoints() to ensure the device descriptors match the driver's requirements before use.

Affected products

  • Linux Linux Kernel 2.6.12-rc2 to 6.13

Timeline

  • 2026-02-12: disclosed: Initial patch submitted by Ziyi Guo
  • 2026-02-26: patched: Patch committed to stable branches
  • 2026-05-27: advisory: CVE-2026-45923 published

References