The Linux kernel's kalmia USB network driver contained a vulnerability in the kalmia_rx_fixup() function where usb_packet_length was computed as skb->len minus twice the KALMIA_HEADER_LENGTH (6), but only a minimal pre-loop check ensured skb->len was at least 6. A malicious device could send short bulk-IN frames with skb->len between 6 and 11 or leave a trailing remainder, causing usb_packet_length to underflow to a large unsigned value (~65530). This bypassed the intended truncation logic comparing usb_packet_length and ether_packet_length, allowing the device-supplied ether_packet_length (up to 65535) to drive memcmp(), skb_trim(), and skb_pull() calls beyond the allocated rx buffer size (14000 bytes), resulting in an out-of-bounds read. The vulnerability was fixed by requiring both start and end framing headers to be present before subtracting them in every loop iteration.

The vulnerability allows a malicious USB device to cause out-of-bounds memory reads in kernel space by exploiting improper length calculations in the kalmia_rx_fixup() function. This can lead to information disclosure or kernel memory corruption. There is no indication of known exploits in the wild. The impact is limited to systems using the affected kalmia USB network driver in the Linux kernel.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a Linux kernel vulnerability, monitor official Linux kernel security advisories for patches addressing CVE-2026-64351. Until a patch is applied, avoid using untrusted USB devices that could exploit this vulnerability.