CVE-2026-23312

What it actually does

The kaweth USB driver performs no validation of endpoint count or type during probe and binds unconditionally, causing later URB access to dereference invalid or missing endpoints and trigger a kernel crash.

Why it matters to the business

An attacker with physical or emulated USB access can cause targeted Linux systems to crash, producing denial of service that interrupts operations until the host is rebooted.

How an attack unfolds

An attacker presents a USB device that lacks the expected kaweth endpoints; the driver binds without checking, later attempts to use the missing endpoints, and the kernel panics.

How to fix it

Apply a kernel update containing the endpoint validation fix once released; until then, blacklist the kaweth module or restrict physical USB ports.

How to confirm the fix worked

Confirm the driver source contains explicit endpoint count and type checks before binding; test with a deliberately malformed USB device to verify the crash no longer occurs.

Typical attack path

1. Attacker connects or emulates a kaweth-incompatible USB device
2. Kernel loads kaweth driver and skips endpoint validation
3. Driver attempts to submit or access non-existent URBs
4. Kernel dereferences invalid pointers and crashes

How to detect it

Review kernel logs for kaweth-related oops or panic entries immediately after USB insertion; correlate with dmesg timestamps showing driver bind attempts.

What your security team should do

• Blacklist kaweth.ko on systems that do not require it
• Monitor for future kernel updates addressing this issue
• Enforce USB device allow-listing where feasible