CVE-2026-45923

What it actually does

CVE-2026-45923 is an improper input validation flaw in the Linux kernel CATC USB Ethernet driver. During device probing, the driver historically assumed that specific USB endpoint numbers were bulk transmit/receive and interrupt-status endpoints without confirming that the attached USB device actually advertised matching endpoint types. A malformed or malicious USB device can present incompatible endpoint descriptors, causing the driver to submit URBs using incorrect pipe assumptions. The practical impact is local denial of service, most likely a kernel crash, hang, or USB/network subsystem instability when the crafted device is connected and the driver probes it. The CVSS vector indicates local access, low attack complexity, low privileges, no user interaction after device presentation, no confidentiality or integrity impact, and high availability impact.

Why it matters to the business

Successful exploitation can disrupt Linux systems that load the affected CATC USB network driver by crashing or destabilizing the kernel when a malformed USB Ethernet device is attached. The main business risk is availability: affected endpoints, appliances, lab systems, kiosks, industrial workstations, or servers with exposed USB access could experience unexpected downtime. Risk is higher where untrusted users can plug in USB devices, where physical access controls are weak, or where USB device pass-through is available in virtualization environments. The vulnerability is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has very low EPSS, and has no reported public exploit maturity, so broad remote exploitation is unlikely; however, physical or local access scenarios remain relevant.

How an attack unfolds

An attacker needs local capability to introduce a malicious or malformed USB device to a vulnerable Linux system, either through physical USB access or an equivalent USB pass-through path. The attacker programs or selects a USB device that identifies in a way that causes the CATC USB Ethernet driver to bind, but provides endpoint descriptors whose transfer types do not match the driver’s assumptions for endpoint 1 bulk TX/RX and endpoint 2 interrupt status. When the device is connected, the kernel probes it, sets the interface, and the vulnerable driver initializes URBs using hardcoded endpoint pipes without validating descriptor compatibility. Subsequent driver initialization or USB transfer handling can fail in a way that destabilizes the kernel or USB networking stack, resulting in denial of service. The upstream fix adds explicit endpoint validation so devices with mismatched descriptors are rejected during probe instead of being used unsafely.

How to fix it

Apply a Linux kernel update that includes the CATC USB Ethernet driver fix adding endpoint validation with usb_check_bulk_endpoints() and usb_check_int_endpoints() after usb_set_interface(). Because no exact fixed package versions were provided, use vendor advisories for the relevant Linux distribution or kernel branch to identify the corrected kernel build. Reboot into the updated kernel after installation and remove or disable older vulnerable kernels where operationally feasible. If immediate patching is not possible, reduce exposure by disabling or blacklisting the CATC USB Ethernet driver if it is not required, restricting physical USB access, disabling unused USB ports in firmware or operating-system policy, and preventing untrusted USB pass-through to Linux guests. Example mitigation approaches may include blocking the relevant module through modprobe configuration where compatible with operational needs, enforcing USB device control policies, and limiting administrative or physical access to systems that can load USB network drivers.

How to confirm the fix worked

Confirm that systems are running a vendor kernel version containing the CATC endpoint validation fix. Validate exposure by checking whether the CATC USB Ethernet driver module is present or loaded and whether systems allow untrusted USB devices. On Linux systems, review kernel package versions, running kernel versions, and module availability using standard distribution tooling and commands such as uname -r, package manager queries, lsmod, modinfo, and modprobe configuration review. If the driver is not needed, confirm that it cannot be loaded and that USB device-control policy blocks unauthorized network adapters. Where practical in a controlled lab only, attach a malformed test device to a patched system and verify that the device is rejected at probe time rather than causing instability. Also confirm that systems have rebooted into the patched kernel, because installing a kernel package alone does not remediate a running vulnerable kernel.

Typical attack path

1. Obtain local physical access to a Linux system or an environment that allows USB device pass-through to the target.
2. Prepare a malformed USB device that presents itself as compatible with the CATC USB Ethernet driver but advertises incorrect endpoint transfer types.
3. Connect or pass through the crafted USB device to the target system.
4. Trigger kernel driver probing and binding for the CATC USB Ethernet device.
5. Cause the vulnerable driver to initialize URBs using hardcoded endpoint assumptions against mismatched descriptors.
6. Induce kernel instability, crash, hang, or loss of availability for the affected system.

How to detect it

Look for evidence of suspicious USB device insertion followed by CATC driver probing errors, kernel warnings, kernel oops/panic events, sudden reboots, or USB/network subsystem instability. Relevant sources include Linux kernel logs, systemd journal, /var/log/kern.log, /var/log/messages, crash dump directories, audit logs if USB monitoring is enabled, endpoint telemetry, and hypervisor logs for USB pass-through events. Search for CATC driver messages, USB device enumeration records, new USB network interface creation, malformed descriptor or endpoint-related errors, and crashes temporally correlated with USB insertion. Because this is a local availability issue and no public exploitation indicators or threat actors are known, detection should focus on behavioral correlation: unauthorized USB insertion plus immediate kernel instability. Preserve dmesg output, journal entries around the insertion time, vmcore/kdump artifacts, and lsusb-style device descriptors if available.

• catc
• catc_probe
• usb_check_bulk_endpoints
• usb_check_int_endpoints
• CATC
• usbcore
• new high-speed USB device
• new full-speed USB device
• New USB device found
• Product: CATC
• kernel panic
• Kernel panic
• Oops:
• BUG: kernel NULL pointer dereference
• unable to handle kernel
• URB
• endpoint descriptor
• usb_submit_urb
• /var/log/kern.log
• /var/log/messages
• /var/crash/
• /var/lib/systemd/coredump/

What your security team should do

• Prioritize patching Linux systems where untrusted users have physical access, USB ports are exposed, or USB pass-through to Linux workloads is allowed.
• Identify systems with the CATC USB Ethernet driver available or loaded and determine whether the hardware support is actually required.
• If the driver is unnecessary, blacklist or disable it and enforce USB device-control policies to prevent unauthorized USB Ethernet adapters.
• Apply vendor kernel updates and reboot systems into the fixed kernel; verify that older vulnerable kernels are not the active boot target.
• Harden physical access controls for servers, kiosks, workstations, labs, and operational technology systems where USB access could cause business disruption.
• Monitor kernel logs for USB probe errors, CATC driver activity, unexpected USB Ethernet adapter insertion, kernel oopses, panics, or system resets following USB events.
• Treat unexpected crashes associated with newly connected USB devices as potentially malicious and preserve kernel logs, crash dumps, and device metadata for investigation.