CVE-2026-64351
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() kalmia_rx_fixup() computes usb_packet_length = skb->len - (2 * KALMIA_HEADER_LENGTH) as a u16, guarded only by a pre-loop check that skb->len is at least KALMIA_HEADER_LENGTH, which is 6. A device can deliver a short bulk-IN frame with skb->len in the 6 to 11 range, or leave a short trailing remainder on a later loop iteration. Either case underflows usb_packet_length to about 65530. That bypasses the usb_packet_length < ether_packet_length truncation path. The device-supplied ether_packet_length, a le16 up to 65535 read from header_start[2], then drives a memcmp() and the following skb_trim() and skb_pull() past the end of the rx buffer. The rx buffer is hard_mtu * 10, which is 14000 bytes. That is an out of bounds read. Require both the start and end framing headers to be present before subtracting them, on every loop iteration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64351
EUVD
EUVD-2026-48895

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a buffer overflow issue in the Linux kernel's USB networking driver for Kalmia devices. It occurs in the kalmia_rx_fixup() function where a calculation for usb_packet_length can underflow to a large value due to insufficient validation of input data. This allows a malicious device to manipulate the packet length, causing the kernel to read beyond the allocated buffer during network packet processing.

Detection Guidance

This vulnerability involves a USB network device driver (kalmia) in the Linux kernel. Detection requires checking if the affected driver is loaded and inspecting kernel logs for malformed USB packets. Use commands like 'lsmod | grep kalmia' to check if the module is loaded, and 'dmesg | grep kalmia' to review kernel logs for errors related to short bulk-IN frames or buffer underflows.

Impact Analysis

This vulnerability could allow an attacker with physical access to a vulnerable system to potentially execute arbitrary code, cause a denial of service, or escalate privileges. It specifically affects systems using USB network adapters with Kalmia chipsets when processing maliciously crafted network packets.

Mitigation Strategies

Immediate mitigation involves unloading the vulnerable kalmia driver if loaded, updating the Linux kernel to a patched version, and restricting access to USB network devices. Use 'rmmod kalmia' to unload the module temporarily. Permanently disable it by blacklisting it in '/etc/modprobe.d/blacklist.conf'. Ensure your kernel is updated to a version containing the fix for CVE-2026-64351.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64351. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart