CVE-2026-23290

In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: validate USB endpoints The pegasus driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints.

CVSS 3.1

5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-25)

Published

2026-03-25

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• linux:linux_kernel

References

• https://git.kernel.org/stable/c/11de1d3ae5565ed22ef1f89d73d8f2d00322c699
• https://git.kernel.org/stable/c/43d7c4114b1ec14f41f09306525d3b9382286fc1
• https://git.kernel.org/stable/c/7f8505c7ce3f186ef9d2495f3c0bd6ad6fce999f
• https://git.kernel.org/stable/c/95556b4e879711693c9865ba0938c148f62d5ea4
• https://git.kernel.org/stable/c/af7369ae572f53cb701731a4289ec3b3889bc501

Check your stackJSON