CVE-2026-97540 Linux CVE debrief

Who should care

Linux system administrators and users of systems with the Pegasus USB driver should assess their exposure to this vulnerability and verify patch application to prevent potential issues.

Why it matters

The Linux kernel vulnerability in the Pegasus USB driver may lead to potential issues with dynamic ID handling. Linux system administrators and users should assess their exposure and verify patch application to prevent potential issues.

• Verify patch application for the Pegasus USB driver to prevent potential issues
• Assess Linux system exposure to CVE-2026-97540
• Monitor system logs for potential issues related to the Pegasus USB driver

Technical summary

The Linux kernel's Pegasus USB driver has a vulnerability related to dynamic ID handling. The driver incorrectly uses pointer arithmetic on the usb_device_id parameter of the probe function, which can lead to out-of-bounds indexing when dynamic IDs are involved. To fix this, the driver_info field of the usb_device_id is used instead of maintaining a side table for additional information. The dynamic ID parsing code has been updated to write to the reserved entry for dynamic IDs and remove the unusual loop.

Defensive priority

Assess exposure of Linux systems using the Pegasus USB driver and verify patch application.

Recommended defensive actions

• Assess Linux system exposure to CVE-2026-97540
• Verify patch application for the Pegasus USB driver
• Monitor system logs for potential issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the Linux kernel's Pegasus USB driver. However, specific impact and remediation details are limited. Further verification is needed to assess the full scope of affected systems and to confirm patch application. The dynamic ID handling vulnerability in the Pegasus USB driver may have implications for Linux system security, and defenders should verify patch application and monitor system logs for potential issues. The source details are limited, so explicit evidence is

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.