CVE-2026-23021

What it actually does

Memory leak in net:usb:pegasus driver when usb_submit_urb fails inside update_eth_regs_async, leaving allocated resources unreleased and gradually exhausting kernel memory.

Why it matters to the business

Systems using affected USB Ethernet adapters may experience slow memory exhaustion leading to performance degradation or crashes; low exploitability and limited prevalence reduce urgency but patching is still required for long-running Linux deployments.

How an attack unfolds

An attacker with local access triggers repeated failures in asynchronous USB register writes on a pegasus device; each failure leaks memory without releasing buffers, eventually causing denial of service through resource exhaustion.

How to fix it

Update linux-virt to 6.12.25-r0 or later, linux-virt-doc to 6.12.25-r0 or later, and apply commit 5397ea6d21c35a17707e201a60761bdee00bcc4e in the stable kernel tree; disable the pegasus driver if the hardware is not required.

How to confirm the fix worked

Confirm kernel package versions match or exceed the listed fixed releases, review dmesg and slabinfo for pegasus-related allocations after simulated URB failures, and ensure the patched update_eth_regs_async path properly frees resources on error.

Typical attack path

1. Obtain local user access on a Linux system with a pegasus USB Ethernet adapter present
2. Trigger conditions that cause usb_submit_urb to fail during async register updates
3. Repeat the operation to accumulate leaked memory allocations
4. Wait for memory pressure to induce system instability or crash

How to detect it

Review kernel logs for pegasus and usb_submit_urb error paths, monitor slabinfo or kmemleak reports for unreleased buffers in the pegasus module, and correlate with repeated async register write failures.

What your security team should do

• Apply the listed kernel updates immediately on any system exposing pegasus USB devices
• Audit inventory for presence of pegasus-based adapters and prioritize those hosts
• Monitor kernel memory usage and slab caches for unexpected growth tied to usbnet or pegasus
• Consider blacklisting the pegasus module on systems where the hardware is unnecessary