In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() kalmia_rx_fixup()… (CVE-2026-64351)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 2% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Since this is a Linux kernel vulnerability, monitor official Linux kernel security advisories for patches addressing CVE-2026-64351. Until a patch is applied, avoid using untrusted USB devices that could exploit this vulnerability.
Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() kalmia_rx_fixup() computes usb_packet_length = skb->len - (2 * KALMIA_HEADER_LENGTH) as a u16, guarded only by a pre-loop check that skb->len is at least KALMIA_HEADER_LENGTH, which is 6. A device can deliver a short bulk-IN frame with skb->len in the 6 to 11 range, or leave a short trailing remainder on a later loop iteration. Either case underflows usb_packet_length to about 65530. That bypasses the usb_packet_length < ether_packet_length truncation path. The device-supplied ether_packet_length, a le16 up to 65535 read from header_start[2], then drives a memcmp() and the following skb_trim() and skb_pull() past the end of the rx buffer. The rx buffer is hard_mtu * 10, which is 14000 bytes. That is an out of bounds read. Require both the start and end framing headers to be present before subtracting them, on every loop iteration.
Impact
The vulnerability allows a malicious USB device to cause out-of-bounds memory reads in kernel space by exploiting improper length calculations in the kalmia_rx_fixup() function. This can lead to information disclosure or kernel memory corruption. There is no indication of known exploits in the wild. The impact is limited to systems using the affected kalmia USB network driver in the Linux kernel.
Summary
The Linux kernel's kalmia USB network driver contained a vulnerability in the kalmia_rx_fixup() function where usb_packet_length was computed as skb->len minus twice the KALMIA_HEADER_LENGTH (6), but only a minimal pre-loop check ensured skb->len was at least 6. A malicious device could send short bulk-IN frames with skb->len between 6 and 11 or leave a trailing remainder, causing usb_packet_length to underflow to a large unsigned value (~65530). This bypassed the intended truncation logic comparing usb_packet_length and ether_packet_length, allowing the device-supplied ether_packet_length (up to 65535) to drive memcmp(), skb_trim(), and skb_pull() calls beyond the allocated rx buffer size (14000 bytes), resulting in an out-of-bounds read. The vulnerability was fixed by requiring both start and end framing headers to be present before subtracting them in every loop iteration.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64351 (opens in a new tab)
- git.kernel.org/stable/c/2d04c37ed4e1d0f733ad39ec35b5a5d8818b4f4a (opens in a new tab)
- git.kernel.org/stable/c/391706889a5112feafdc0c68db3ecc7ed325d09c (opens in a new tab)
- git.kernel.org/stable/c/46ab32870d010e9a057bc5659cea22b7e728ca88 (opens in a new tab)
- git.kernel.org/stable/c/47b6bcef6e679593d2e86e04ee72c46a4e2f7139 (opens in a new tab)
- git.kernel.org/stable/c/51e65f1d78457ea4f9513d90ab22c9dccbb35110 (opens in a new tab)
- git.kernel.org/stable/c/aa4eef2cbb66ea3dfcfc24bdce798dd78a81b54b (opens in a new tab)
- git.kernel.org/stable/c/c466097d85d52f3aa200736cb4759e66d4bbf6e3 (opens in a new tab)
- git.kernel.org/stable/c/e24eb271061db384a3c3ef6f107fe515e68ef222 (opens in a new tab)