CVE-2026-23365

Vulnerability

The Linux kernel's kalmia USB: kalmia` driver fails to validate the number and types of USB endpoints present on a device before binding to it. The driver assumes a specific endpoint configuration and will blindly access endpoints without checking if they exist or their types are correct. This missing validation can lead to a NULL pointer dereference or other memory safety issues when the driver attempts to use endpoints that do not exist or are of an unexpected type [1][2][3][4].

Exploitation

An attacker with physical access to the system can plug in a malicious USB device that presents itself as a kalmia device but does not have the expected endpoints. No authentication is required beyond the ability to connect a USB device. The attack surface is limited to systems where the kalmia driver is loaded and a malicious device can be attached.

Impact

If exploited, the vulnerability can cause a kernel crash (denial of service) due to the driver's unsafe access to invalid endpoint structures. The CVSS v3 score of 5.5 (Medium) reflects the requirement for physical access and the resulting availability impact.

Mitigation

The fix has been applied in the Linux kernel stable tree via commits [1][2][3][4]. Users should update their kernel to a version containing these patches. No workaround is available other than not using the kalmia driver or physically securing USB ports.