CVE-2026-23290: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23290 is a denial-of-service vulnerability in the Linux kernel's net/usb/pegasus USB Ethernet driver caused by missing USB endpoint validation. When the driver probes a USB device, it fails to verify that the device exposes the expected number and types of endpoints (URBs) before binding to it; a malicious or misconfigured device lacking those endpoints will cause a kernel crash. The vulnerability was published on March 25, 2026, and affects Linux kernel versions from 2.6.12.1 through multiple stable branches up to (but not including) the patched releases. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Microsoft MSRC).

The root cause is classified as CWE-909 (Missing Initialization of Resource): the pegasus driver blindly accesses USB endpoint structures without first confirming they exist on the probed device. An attacker with physical or logical access to a USB port can present a crafted USB device that advertises the pegasus-compatible USB IDs but omits the required bulk-in, bulk-out, or interrupt endpoints. When the driver subsequently attempts to use these missing endpoints to set up URBs, it dereferences uninitialized or NULL pointers, triggering a kernel panic. The fix adds explicit endpoint-count and endpoint-type validation during the probe phase before any endpoint is accessed (Red Hat CVE, Kernel Patch).

Successful exploitation results in a kernel crash (panic), causing a complete system denial of service with high availability impact. There is no confidentiality or integrity impact, as the vulnerability does not expose data or allow code execution. The affected scope is limited to the local system where the malicious USB device is connected; lateral movement is not directly facilitated by this vulnerability (Red Hat CVE).

1. Prepare a malicious USB device: Using a programmable USB device (e.g., a microcontroller with USB device emulation such as a Facedancer or similar hardware), configure it to present a USB device ID that matches the pegasus driver's supported ID table, but omit or misconfigure the required bulk-in, bulk-out, and interrupt endpoints.
2. Gain physical access: Connect the crafted USB device to an exposed USB port on a target Linux system running a vulnerable kernel version (e.g., kernel < 5.10.253, < 5.15.203, < 6.1.167, < 6.6.130, < 6.12.77, < 6.18.17, or < 6.19.7).
3. Trigger driver probe: The Linux USB subsystem automatically detects the device and invokes the pegasus driver's probe function based on the matching USB ID.
4. Induce kernel crash: The pegasus driver attempts to access the expected endpoints without validation; since the endpoints are absent, it dereferences a NULL or invalid pointer, causing a kernel panic and system crash (denial of service) (Red Hat CVE).

• Physical: Unexpected or unrecognized USB device connected to a system port around the time of a kernel panic.
• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing the pegasus driver module and NULL pointer dereference or invalid memory access during USB device probe.
• Logs: System crash/reboot events logged in /var/log/syslog or systemd journal (journalctl -b -1) coinciding with USB device insertion events.
• Process/System: Unexpected system reboots or kernel panics on systems with USB ports accessible to untrusted users.

Apply the patched Linux kernel version for your branch: 5.10.253+, 5.15.203+, 6.1.167+, 6.6.130+, 6.12.77+, 6.18.17+, or 6.19.7+. Patches are available via the upstream stable kernel tree and have been incorporated into distributions including Debian (DSA-6238, DSA-6243, DLA-4561), SUSE (SUSE-SU-2026:2068-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), Amazon Linux 2 (ALAS2KERNEL-5.10-2026-118), and Microsoft Azure Linux 3. As a workaround where patching is not immediately possible, blacklist the pegasus kernel module (echo 'blacklist pegasus' >> /etc/modprobe.d/blacklist.conf) if USB-to-Ethernet adapters using the pegasus driver are not required, and restrict physical USB port access to trusted personnel (Red Hat CVE, Microsoft MSRC).