CVE-2026-23312: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23312 is a denial-of-service vulnerability in the Linux kernel's kaweth USB network driver caused by insufficient validation of USB endpoints during device probing. The driver fails to verify that a connected USB device exposes the expected number and types of endpoints before binding to it, allowing a malicious or malformed USB device to trigger a kernel crash. It affects the Linux kernel from version 2.6.12 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc2. Disclosed on March 25, 2026, it carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as CWE-1288 (Improper Validation of Consistency within Input): the kaweth driver blindly accesses USB endpoint structures (URBs) without first confirming the device presents the required endpoint configuration. When a malicious USB device is plugged in without the expected bulk-in, bulk-out, or interrupt endpoints, the driver dereferences invalid or null pointers during its initialization sequence, causing a kernel panic. Exploitation requires local physical or logical access to connect a crafted USB device. Patches adding endpoint validation checks before driver binding have been committed to multiple stable kernel trees (Red Hat CVE, Kernel Patch).

Successful exploitation results in a kernel crash (panic), causing a complete system availability loss — a denial of service affecting the entire host. There is no confidentiality or integrity impact, as the vulnerability only affects availability. The scope is limited to the local system; lateral movement is not directly enabled by this vulnerability (Red Hat CVE).

1. Prerequisite: Obtain physical or logical access to a target Linux system running a vulnerable kernel version with the kaweth USB driver loaded or loadable.
2. Craft malicious USB device: Prepare a USB device (e.g., using a programmable USB microcontroller such as a Facedancer or similar hardware) that presents a USB device descriptor matching the kaweth driver's vendor/product ID but omits or misrepresents the required bulk-in, bulk-out, or interrupt endpoints.
3. Connect device: Plug the crafted USB device into the target system. The kernel's USB subsystem enumerates the device and invokes the kaweth driver's probe function.
4. Trigger crash: The kaweth driver attempts to access the expected USB endpoints without validation, dereferences an invalid pointer, and causes a kernel panic, resulting in system downtime (Red Hat CVE).

• Logs: Kernel panic messages in /var/log/kern.log or dmesg output referencing the kaweth driver, such as BUG: unable to handle kernel NULL pointer dereference or kaweth in the stack trace.
• System Events: Unexpected system reboots or crashes coinciding with USB device connection events, visible in system uptime records or crash dump files (e.g., /var/crash/).
• USB Events: dmesg or udev logs showing a USB device with kaweth-compatible vendor/product IDs being connected immediately before a crash (usb X-Y: new full-speed USB device followed by kaweth probe messages).

Apply the available kernel patches that add USB endpoint validation to the kaweth driver. Fixed versions are: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc2. Distributions including Debian, SUSE, and Amazon Linux have released updated packages. As a workaround, restrict physical USB port access to trusted users, or blacklist the kaweth kernel module (echo 'blacklist kaweth' >> /etc/modprobe.d/blacklist.conf) if the driver is not needed (Red Hat CVE, SUSE Advisory).