CVE-2026-43156

Vulnerability

Details

The pegasus driver in the Linux kernel hardcoded endpoint pipes for RX, TX, and status interrupts—using endpoints 1, 2, and 3 respectively—without verifying the corresponding endpoint descriptors. A malformed USB device could present these endpoints with transfer types that differ from what the driver expects, leading to potential misuse of USB pipes [1][2][3][4].

Exploitation

To exploit this, an attacker needs to be able to connect a malicious USB device to the target system. No authentication is required; the vulnerability is triggered during device enumeration when the driver's probe function (pegasus_probe()) attempts to fill URBs using the hardcoded endpoint numbers. The bug is reachable by any user with physical or locally accessible USB ports.

Impact

Successful exploitation can cause the kernel to trigger an assertion failure or enter an undefined state due to mismatched endpoint transfer types. While the CVSS score is 5.5 (medium), the consequence is a denial of service or potential system instability.

Mitigation

The fix introduces usb_check_bulk_endpoints() and usb_check_int_endpoints() calls in the probe path and replaces magic constants with a pegasus_usb_ep enum. The patches are available in stable kernel updates [1][2][3][4], and users are advised to apply the latest stable kernel or backport the commits.