CVE-2026-23365 Linux CVE debrief

Who should care

Users of Linux kernel versions 3.0.1 to 6.19.7, and 7.0 rc1 to rc7, should validate their systems for this vulnerability and apply patches if necessary. System administrators and security teams responsible for Linux-based systems should review their deployments and ensure that necessary mitigations are in place. This vulnerability may impact system stability and security if not properly addressed.

Technical summary

The kalmia driver in the Linux kernel does not validate the number and types of USB endpoints of a device before binding to it. This can lead to a crash if a malicious device with a different number or type of endpoints is used. The vulnerability has been resolved by adding endpoint validation to the kalmia driver. Affected Linux kernel versions include 3.0.1 to 6.19.7, and 7.0 rc1 to rc7. Users should review their system configurations and apply patches to fix the vulnerability.

Defensive priority

Medium priority, as the vulnerability requires a malicious device to be connected to the system.

Recommended defensive actions

• Validate the USB endpoints of devices before binding to them
• Apply patches to the Linux kernel to fix the vulnerability
• Monitor systems for potential crashes or issues with USB devices
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved by adding endpoint validation to the kalmia driver. The Linux kernel versions 3.0.1 to 6.19.7, and 7.0 rc1 to rc7, are affected. Further verification is needed to confirm the scope of affected deployments and to apply patches or mitigations as necessary. Evidence limits suggest that additional details may be required to fully understand the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.