CVE-2026-97540: Linux kernel · net: usb: pegasus: don't rely on id table pointer arithmetic
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in ce8101c331956bbd3e20681331dfd22eb7c1c1ea : update Linux kernel when convenient.
Data as of 26 Oct 2026, 13:44 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in ce8101c331956bbd3e20681331dfd22eb7c1c1ea, 7654812b65047349ea4c111eed42c4315a00e462, 9425a13960ef38bac237608f25c9ee64ff113086 +3
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available and has been applied in multiple commits to the Linux kernel. Users should update to a Linux kernel version that includes these fixes. No additional mitigation steps are indicated by the vendor advisory.
Description
A vulnerability in the Linux kernel's net: usb: pegasus driver involves incorrect pointer arithmetic on the usb_device_id table when dynamic IDs are used. This flaw causes out-of-bound indexing due to the usb_device_id parameter residing on the heap. The issue has been addressed by changing the handling of dynamic IDs to use the driver_info field and removing problematic pointer arithmetic.
References
- git.kernel.org/stable/c/7c940a1100cb0aa18a54dc48d736c0525c0f400c (opens in a new tab)
- git.kernel.org/stable/c/05d47f540d85c8f6697ec5cfc1aa7b4f96a5b31b (opens in a new tab)
- git.kernel.org/stable/c/9425a13960ef38bac237608f25c9ee64ff113086 (opens in a new tab)
- git.kernel.org/stable/c/7654812b65047349ea4c111eed42c4315a00e462 (opens in a new tab)
- git.kernel.org/stable/c/61b84e964a829d534f24eab4cbd4035d22b52601 (opens in a new tab)
- git.kernel.org/stable/c/ce8101c331956bbd3e20681331dfd22eb7c1c1ea (opens in a new tab)