PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45923 Linux CVE debrief

CVE-2026-45923 documents a vulnerability in the Linux kernel's CATC USB Ethernet driver (net/usb/catc.c). The driver failed to validate USB endpoint descriptors before use, assuming hardcoded endpoint numbers (1 for bulk TX/RX, 2 for interrupt status) without verifying their transfer types. A malicious USB device could present endpoints with mismatched transfer types, potentially causing undefined behavior or driver malfunction. The fix introduces explicit endpoint checking using usb_check_bulk_endpoints() and usb_check_int_endpoints() after usb_set_interface(), rejecting devices with non-conforming descriptors at probe time. This follows the same pattern as CVE-2024-XXXX (rtl8150) fixed in commit 90b7f2961798. Multiple stable kernel branches received backports.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Linux system administrators running kernels with CATC USB Ethernet support; security teams tracking USB attack surface in Linux environments; kernel maintainers reviewing USB driver endpoint validation patterns

Technical summary

The CATC USB Ethernet driver (drivers/net/usb/catc.c) used hardcoded endpoint numbers without verifying descriptor transfer types. The vulnerability allowed malicious USB devices to present unexpected endpoint configurations. The resolution adds usb_check_bulk_endpoints() and usb_check_int_endpoints() validation after interface setup, with an enum replacing magic constants for maintainability.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available for your distribution
  • For systems using CATC-based USB Ethernet adapters, prioritize patching if untrusted USB device attachment is possible
  • Verify endpoint validation patterns in custom USB drivers against this fix pattern
  • Monitor distribution security advisories for kernel package updates addressing CVE-2026-45923

Evidence notes

The CVE description and kernel.org commits confirm the vulnerability class: missing USB endpoint descriptor validation in a network driver. The fix pattern mirrors prior art in rtl8150 (commit 90b7f2961798 referenced in description). Seven stable branch commits provided indicate widespread backporting. No CVSS score or CPE data available at time of disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45923 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45923

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45923 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45923

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/163d04897e57633c5d2e69734e4e4b22bb63f50d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1a42cfced8900d33d032c7ec338484855b61b8cc

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/36c28b028efba0f42218d41fed12c47ce217c1f1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9e7021d2aeae57c323a6f722ed7915686cdcc123

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a488001a8197da4f9c413eec8f6acbff71c60145

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ac7739b78ded519e1d9919a814da3b34120bec8c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/eade522d3e6ac3f3bfb51bfa5b5b4b32bd0b846f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.