CVE-2026-43156
MediumSummary
A vulnerability has been identified in the Linux kernel within the USB pegasus module, which involves filling URBs with hardcoded endpoint pipes without verifying their descriptors. This may lead to improper functioning of USB devices.
Risk Assessment
The lack of endpoint verification could lead to potential attacks that may affect system stability and the security of data transmitted through USB devices.
Recommendation
It is recommended to update the Linux kernel to the latest version to eliminate this vulnerability and enable appropriate endpoint verification mechanisms.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: enable basic endpoint checking pegasus_probe() fills URBs with hardcoded endpoint pipes without verifying the endpoint descriptors: - usb_rcvbulkpipe(dev, 1) for RX data - usb_sndbulkpipe(dev, 2) for TX dat