CVE-2026-64351
CVE CVE-2026-64351EUVD EUVD-2026-48895Published 2026-07-25T08:50:10.000Z
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() kalmia_rx_fixup() computes usb_packet_length = skb->len - (2 * KALMIA_HEADER_LENGTH) as a u16, guarded only by a pre-loop check that skb->len is at least KALMIA_HEADER_LENGTH, which is 6. A device can deliver a short bulk-IN frame with skb->len in the 6 to 11 range, or leave a short trailing remainder on a later loop iteration. Either case underflows usb_packet_length to about 65530. That bypasses the usb_packet_length < ether_packet_length truncation path. The device-supplied ether_packet_length, a le16 up to 65535 read from header_start[2], then drives a memcmp() and the following skb_trim() and skb_pull() past the end of the rx buffer. The rx buffer is hard_mtu * 10, which is 14000 bytes. That is an out of bounds read. Require both the start and end framing headers to be present before subtracting them, on every loop iteration.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux d40261236e8e278cb1936cb5e934262971692b10 <47b6bcef6e679593d2e86e04ee72c46a4e2f7139; d40261236e8e278cb1936cb5e934262971692b10 <51e65f1d78457ea4f9513d90ab22c9dccbb35110; patch: 5.10.261; d40261236e8e278cb1936cb5e934262971692b10 <391706889a5112feafdc0c68db3ecc7ed325d09c; d40261236e8e278cb1936cb5e934262971692b10 <46ab32870d010e9a057bc5659cea22b7e728ca88; patch: 6.1.178; patch: 7.1.4; patch: 6.12.96; d40261236e8e278cb1936cb5e934262971692b10 <2d04c37ed4e1d0f733ad39ec35b5a5d8818b4f4a; patch: 5.15.212; patch: 6.6.145; d40261236e8e278cb1936cb5e934262971692b10 <aa4eef2cbb66ea3dfcfc24bdce798dd78a81b54b; 3.0; patch: 6.18.39; d40261236e8e278cb1936cb5e934262971692b10 <c466097d85d52f3aa200736cb4759e66d4bbf6e3; patch: 0; patch: 7.2-rc1; d40261236e8e278cb1936cb5e934262971692b10 <e24eb271061db384a3c3ef6f107fe515e68ef222
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.