CVE-2026-23365

What it actually does

The kalmia USB driver in the Linux kernel fails to validate the number and type of USB endpoints on a probed device before binding, allowing subsequent blind URB accesses that trigger a kernel crash (availability impact only).

Why it matters to the business

Systems running affected kernels can experience unexpected crashes or denial of service when certain USB devices are attached; the issue affects any Linux deployment using the kalmia driver with untrusted USB hardware, though low exploitability and absence from known campaigns limit widespread operational disruption.

How an attack unfolds

An attacker with physical or local access supplies a USB device that lacks the expected endpoints; once the driver binds without validation, later code paths dereference invalid endpoint structures, causing the kernel to panic.

How to fix it

Update to a kernel release containing the endpoint validation fix for the kalmia driver; if a backport is unavailable, disable the kalmia module or restrict untrusted USB device attachment until a patched kernel can be deployed.

How to confirm the fix worked

Confirm the presence of endpoint count and type checks in the kalmia_probe function of the updated driver source; test by attaching non-conforming USB devices and verifying no crash occurs.

Typical attack path

1. Gain local or physical access to a Linux system with the kalmia driver loaded
2. Attach a malicious USB device missing the expected endpoint configuration
3. Trigger driver binding and subsequent URB operations that access unvalidated endpoints
4. Cause kernel crash resulting in denial of service

How to detect it

Review kernel logs for oops or panic messages mentioning kalmia, usb_submit_urb failures, or invalid endpoint dereferences around the time of USB device insertion; correlate with dmesg entries showing driver binding to unexpected USB descriptors.

• kalmia
• usb_endpoint
• invalid endpoint

What your security team should do

• Prioritize kernel updates on systems exposing the kalmia driver to untrusted USB ports
• Monitor for kernel oops or panic logs referencing kalmia or USB endpoint handling
• Apply least-privilege USB device policies where feasible