CVE-2026-23679 is a denial of service vulnerability in libusb where processing a malformed USB configuration descriptor causes a null pointer dereference, crashing the application. Exploitation requires the application to handle such malformed descriptors, which can occur through virtualized USB passthrough, file parsing, or network sources. The vulnerability affects Red Hat Hardened Images RPMs, specifically libusb1 packages for aarch64 and x86_64 architectures. The flaw impacts system availability but does not enable arbitrary code execution. Red Hat has issued an update (libusb1-1.0.30-1.hum1) to fix this issue.

The vulnerability causes a denial of service by crashing applications that process malformed USB configuration descriptors via libusb. It affects system availability but does not compromise confidentiality or integrity. There is no indication of arbitrary code execution or privilege escalation. Exploitation requires local or controlled input of malformed USB descriptors, such as through virtualized USB passthrough or file/network-based descriptor parsing.

Red Hat has released updated libusb1 packages (version 1.0.30-1.hum1) for affected architectures to fix this vulnerability. Users of Red Hat Hardened Images should apply this update to remediate the issue. No additional mitigations are specified or required beyond applying the official update.