CVE-2026-23365: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23365 is a missing USB endpoint validation vulnerability in the Linux kernel's net/usb/kalmia driver. The driver fails to verify that a probed USB device has the expected number and types of endpoints before binding to it, allowing a malicious USB device to trigger a kernel crash. It affects the Linux kernel from version 3.0 through multiple stable branches up to 6.19.x and 7.0 release candidates. Disclosed on March 25, 2026, it carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is improper validation of specified input type (CWE-1287): the kalmia driver blindly accesses USB endpoint structures (URBs) without first confirming they exist on the connected device. An attacker with physical access to a USB port can connect a crafted USB device that advertises the kalmia USB IDs but omits the expected bulk/interrupt endpoints. When the driver attempts to use these non-existent endpoints during initialization or data transfer, a null pointer dereference or out-of-bounds access occurs, crashing the kernel. The attack vector is local (physical USB access required), with low privileges needed and no user interaction beyond plugging in the device (Red Hat Advisory, Feedly).

Successful exploitation results in a kernel panic, causing a complete denial of service — the affected system becomes unstable and unavailable until rebooted. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue. The scope is limited to the local system, with no evidence of lateral movement potential (Red Hat Advisory).

1. Acquire or craft a malicious USB device: Prepare a USB device (e.g., using a programmable microcontroller such as a Facedancer or similar USB fuzzing tool) that presents the USB vendor/product IDs matched by the kalmia driver but deliberately omits the expected bulk USB endpoints.
2. Identify a target system: Locate a Linux system running a vulnerable kernel version (3.0 through the unpatched branches) with USB ports accessible and the kalmia driver loaded or auto-loadable.
3. Connect the malicious device: Plug the crafted USB device into the target system's USB port. The kernel's USB subsystem will enumerate the device and attempt to bind the kalmia driver.
4. Trigger the crash: The kalmia driver, lacking endpoint validation, attempts to access the missing URB endpoints, causing a null pointer dereference or similar memory fault that results in a kernel panic and system crash (denial of service) (Red Hat Advisory).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg referencing the kalmia driver, such as BUG: unable to handle kernel NULL pointer dereference or kalmia: ... stack traces at the time of USB device insertion.
• Logs: USB device enumeration events in dmesg showing a device matching kalmia's USB IDs immediately preceding a kernel crash.
• File System: Kernel crash dump files (e.g., /var/crash/ or kdump output) generated at the time of the incident.
• Process/System: Unexpected system reboot or loss of availability correlated with physical USB device insertion events.

Patches have been released across multiple stable kernel branches. Administrators should update to the following fixed versions or later: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, and 6.19.7. Microsoft Azure Linux 3 users should update to azl3_kernel_6.6.126.1-1 or later. As a workaround where patching is not immediately possible, physically restrict access to USB ports, disable unused USB ports in BIOS/UEFI, or blacklist the kalmia kernel module (echo 'blacklist kalmia' >> /etc/modprobe.d/blacklist.conf) on systems that do not use Samsung Kalmia-based USB modems (Red Hat Advisory, Feedly).