CVE-2026-45923 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: enable basic endpoint checking catc_probe() fills three URBs with hardcoded endpoint pipes without verifying the endpoint descriptors: - usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX - usb_rcvintpipe(usbdev, 2) for interrupt status A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes. Add a catc_usb_ep enum for endpoint numbers, replacing magic constants throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls after usb_set_interface() to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time. Similar to - commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking") which fixed the issue in rtl8150.
A vulnerability exists in the Linux kernel's Catc USB driver, specifically in the endpoint handling of the Catc_probe function. The driver assigns hardcoded endpoint pipes for bulk and interrupt transfers without verifying the endpoint descriptors. This oversight can be exploited by a malformed USB device that presents incorrect transfer types, leading to potential miscommunication between the device and the driver. The issue has been addressed by introducing a new enumeration for endpoint numbers, replacing the magic constants previously used. The updated code now includes checks to validate the endpoint types before use, rejecting devices with mismatched descriptors at probe time.
Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for updating the kernel can be found in the official Linux kernel documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/163d04897e57633c5d2e69734e4e4b22bb63f50d | kernel.org | Patch |
| https://git.kernel.org/stable/c/1a42cfced8900d33d032c7ec338484855b61b8cc | kernel.org | Patch |
| https://git.kernel.org/stable/c/36c28b028efba0f42218d41fed12c47ce217c1f1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/9e7021d2aeae57c323a6f722ed7915686cdcc123 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a488001a8197da4f9c413eec8f6acbff71c60145 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ac7739b78ded519e1d9919a814da3b34120bec8c | kernel.org | Patch |
| https://git.kernel.org/stable/c/eade522d3e6ac3f3bfb51bfa5b5b4b32bd0b846f | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.12.1, < 5.10.252 >= 5.11, < 6.1.165 >= 6.2, < 6.6.128 >= 6.7, < 6.12.75 >= 6.13, < 6.18.14 >= 6.19, < 6.19.4 2.6.12 - 2.6.12 rc2 2.6.12 rc3 2.6.12 rc4 2.6.12 rc5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 27, 2026 | New CVE Received | kernel.org |