CVE-2026-23365

The kalmia driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the driver will crash later on when it blindly accesses these endpoints.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23365.json",
    "cna_assigner": "Linux"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

d40261236e8e278cb1936cb5e934262971692b10

Fixed

28a380bfa5bc7f6a9380b85e8eab919ee6ac1701

Fixed

12c0243de0aee0ab27cc00932fd5edae65c1e3a2

Fixed

51c20ea5f1555a984c041b0dbf56f00d41b9e652

Fixed

011684cd18349aa4c52167c8ac37a0524169f48c

Fixed

7bfda1a0be4caec3263753d567678451cef73a85

Fixed

c58b6c29a4c9b8125e8ad3bca0637e00b71e2693

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23365.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

6.1.167

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.130

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.77

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.17

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

6.19.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23365.json"