Executive brief
A vulnerability was identified in the Linux kernel's driver for Samsung Kalmia USB network adapters. An attacker with physical access or control over a connected USB device could send specially crafted network packets that cause the system to read memory outside of the intended buffer. This could lead to system instability or potentially expose sensitive information from the kernel's memory.
Technical details
An out-of-bounds read vulnerability exists in the kalmia_rx_fixup() function within drivers/net/usb/kalmia.c. The function calculates usb_packet_length by subtracting two header lengths from the socket buffer length (skb->len) without verifying that the buffer is large enough to contain both headers. If a device sends a short frame (6-11 bytes), the u16 usb_packet_length underflows to approximately 65530. This underflow bypasses subsequent truncation checks, allowing a device-supplied ether_packet_length to drive memcmp(), skb_trim(), and skb_pull() operations beyond the 14000-byte RX buffer. The fix introduces a check to ensure both framing headers are present before subtraction.
Affected products
- Linux Linux Kernel d40261236e8e to 47b6bcef6e67
Timeline
- 2026-06-22: other: Patch authored
- 2026-07-24: patched: Commits merged into stable branches
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2d04c37ed4e1d0f733ad39ec35b5a5d8818b4f4a
- https://git.kernel.org/stable/c/391706889a5112feafdc0c68db3ecc7ed325d09c
- https://git.kernel.org/stable/c/46ab32870d010e9a057bc5659cea22b7e728ca88
- https://git.kernel.org/stable/c/47b6bcef6e679593d2e86e04ee72c46a4e2f7139
- https://git.kernel.org/stable/c/51e65f1d78457ea4f9513d90ab22c9dccbb35110
- https://git.kernel.org/stable/c/aa4eef2cbb66ea3dfcfc24bdce798dd78a81b54b
- https://git.kernel.org/stable/c/c466097d85d52f3aa200736cb4759e66d4bbf6e3