Medium 5.5Published May 6, 2026

CVE-2026-43156net: usb: pegasus: enable basic endpoint checking

Updated under an hour ago (Oct 28, 2026, 1:30 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: enable basic endpoint checking pegasus_probe() fills URBs with hardcoded endpoint pipes without verifying the endpoint descriptors: - usb_rcvbulkpipe(dev, 1) for RX data - usb_sndbulkpipe(dev, 2) for TX data - usb_rcvintpipe(dev, 3) for status interrupts A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes. Add a pegasus_usb_ep enum for endpoint numbers, replacing magic constants throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls before any resource allocation to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time, and avoid triggering assertion. Similar fix to - commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking") - commit 9e7021d2aeae ("net: usb: catc: enable basic endpoint checking")

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before a3e64e950a3981a8199de9798f6d21261b959171; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 229dc9b9db475ac900182bafe258943e0e054c6d; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 26b3ec62fa1a94ac801feca47f040fc729b3c174; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 35854ed5c40b02f95824e44398f9d2ba33727203; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 67ba6b13dbcaf45681fb6758794c5ac5fa589a6c; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before d2e7c898cc02dfe42443489a67a45ed616cb76e9; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2705709f6574a088aab246af72fc95f2fea51484; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3d7e6ce34f4fcc7083510c28b17a7c36462a25d4	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.12.1 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6; 2.6.12; and 5 more ranges	NVD

References

References

https://git.kernel.org/stable/c/a3e64e950a3981a8199de9798f6d21261b959171	patch
https://git.kernel.org/stable/c/229dc9b9db475ac900182bafe258943e0e054c6d	patch
https://git.kernel.org/stable/c/26b3ec62fa1a94ac801feca47f040fc729b3c174	patch
https://git.kernel.org/stable/c/35854ed5c40b02f95824e44398f9d2ba33727203	patch
https://git.kernel.org/stable/c/67ba6b13dbcaf45681fb6758794c5ac5fa589a6c	patch
https://git.kernel.org/stable/c/d2e7c898cc02dfe42443489a67a45ed616cb76e9	patch
https://git.kernel.org/stable/c/2705709f6574a088aab246af72fc95f2fea51484	patch
https://git.kernel.org/stable/c/3d7e6ce34f4fcc7083510c28b17a7c36462a25d4	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.