CVE-2026-23312

The kaweth driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23312.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2

Fixed

7c7ebf5e45d2504d92ea294ac3828d58586491df

Fixed

72f90f481c6a059680b9b976695d4cfb04fba1f3

Fixed

f33e80d195a003b384620ee240f69092b519146b

Fixed

2795fc06e7652c0ba299d936c584d5e08b6b57a1

Fixed

0aae18e4638a7c1c579df92bc6edc36cedfaaa8c

Fixed

4b063c002ca759d1b299988ee23f564c9609c875

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23312.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.6.12

Fixed

6.1.167

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.130

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.77

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.17

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

6.19.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23312.json"