CVE-2026-43156
USB Endpoint Validation Flaw in Linux Kernel Pegasus Driver
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's USB driver for Pegasus devices. The pegasus_probe() function fills USB Request Blocks (URBs) with hardcoded endpoint pipes without verifying the actual endpoint descriptors presented by the USB device.
Specifically, it assumes certain endpoints for receiving data, transmitting data, and status interrupts without checking if the device's endpoints match these assumptions. A malformed USB device can present endpoints with transfer types different from what the driver expects, potentially causing issues.
The fix involved adding an enumeration for endpoint numbers and adding checks to verify endpoint types before allocating resources, rejecting devices with mismatched descriptors during the probe phase to avoid triggering assertions.
How can this vulnerability impact me? :
If exploited, this vulnerability could cause the Linux kernel's USB driver to misinterpret endpoint types from a USB device, potentially leading to incorrect handling of USB data transfers.
This could result in system instability, crashes, or unexpected behavior when interacting with malformed or malicious USB devices.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved by enabling basic endpoint checking in the pegasus USB driver within the Linux kernel.
To mitigate this vulnerability, update your Linux kernel to a version that includes the fix which adds verification of USB endpoint descriptors before resource allocation, rejecting devices with mismatched descriptors at probe time.