CVE-2026-64351 - Vulnerability Details

- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()

Description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()

kalmia_rx_fixup() computes usb_packet_length = skb->len - (2 *
KALMIA_HEADER_LENGTH) as a u16, guarded only by a pre-loop check that
skb->len is at least KALMIA_HEADER_LENGTH, which is 6. A device can
deliver a short bulk-IN frame with skb->len in the 6 to 11 range, or
leave a short trailing remainder on a later loop iteration. Either case
underflows usb_packet_length to about 65530.

That bypasses the usb_packet_length < ether_packet_length truncation path.
The device-supplied ether_packet_length, a le16 up to 65535 read from
header_start[2], then drives a memcmp() and the following skb_trim() and
skb_pull() past the end of the rx buffer. The rx buffer is hard_mtu * 10,
which is 14000 bytes. That is an out of bounds read.

Require both the start and end framing headers to be present before
subtracting them, on every loop iteration.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel the kalmia_rx_fixup() function incorrectly calculates the USB packet length for Kalmia USB Ethernet adapters. The calculation treats a subtraction as an unsigned 16‑bit integer, and if the received bulk‑IN frame is only marginally larger than the 6‑byte header, the result underflows to a value around 65530. This underflow bypasses the normal truncation check that limits packet processing to the Ethernet length specified by the device. As a result, memcmp(), skb_trim() and skb_pull() operations can read beyond the end of the receive buffer, which is sized at 14 000 bytes. The out‑of‑bounds read can corrupt kernel memory and cause a kernel panic, leading to a denial of service. The flaw does not grant direct code execution but can destabilise the kernel instance handling the USB device.

Affected Systems

The vulnerability affects Linux kernels that include the Kalmia USB Ethernet driver. It applies to all distributions that ship the driver, regardless of the specific kernel version. All kernel releases containing the unpatched kalmia_rx_fixup() function are therefore vulnerable. It is inferred that any kernel version with this function unmodified is susceptible, although the exact impact may vary by configuration.

Risk and Exploitability

The CVSS score is 5.5. The EPSS score of <1 % indicates a very low probability of widespread exploitation. The CVE is not listed in the CISA KEV catalog. Attackers would need to supply a specially crafted USB device with short bulk‑IN frames; this attack vector is inferred from the requirement for a non‑standard device and thus is local, requiring physical or USB proximity.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d40261236e8e278cb1936cb5e934262971692b10`	affected	< 391706889a5112feafdc0c68db3ecc7ed325d09c
`d40261236e8e278cb1936cb5e934262971692b10`	affected	< aa4eef2cbb66ea3dfcfc24bdce798dd78a81b54b
`d40261236e8e278cb1936cb5e934262971692b10`	affected	< 2d04c37ed4e1d0f733ad39ec35b5a5d8818b4f4a
`d40261236e8e278cb1936cb5e934262971692b10`	affected	< 46ab32870d010e9a057bc5659cea22b7e728ca88
`d40261236e8e278cb1936cb5e934262971692b10`	affected	< c466097d85d52f3aa200736cb4759e66d4bbf6e3
`d40261236e8e278cb1936cb5e934262971692b10`	affected	< e24eb271061db384a3c3ef6f107fe515e68ef222
`d40261236e8e278cb1936cb5e934262971692b10`	affected	< 51e65f1d78457ea4f9513d90ab22c9dccbb35110
`d40261236e8e278cb1936cb5e934262971692b10`	affected	< 47b6bcef6e679593d2e86e04ee72c46a4e2f7139

Linux

affected

Version	Status	Constraints
`3.0`	affected	—
`0`	unaffected	< 3.0
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:3.0:-::::::
	cpe:2.3:o:linux:linux_kernel:3.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:3.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:3.0:rc6::::::
	cpe:2.3:o:linux:linux_kernel:3.0:rc7::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d40261236e8e278cb1936cb5e934262971692b10,391706889a5112feafdc0c68db3ecc7ed325d09c)`	affected	code_commit	—
`[d40261236e8e278cb1936cb5e934262971692b10,aa4eef2cbb66ea3dfcfc24bdce798dd78a81b54b)`	affected	code_commit	—
`[d40261236e8e278cb1936cb5e934262971692b10,2d04c37ed4e1d0f733ad39ec35b5a5d8818b4f4a)`	affected	code_commit	—
`[d40261236e8e278cb1936cb5e934262971692b10,46ab32870d010e9a057bc5659cea22b7e728ca88)`	affected	code_commit	—
`[d40261236e8e278cb1936cb5e934262971692b10,c466097d85d52f3aa200736cb4759e66d4bbf6e3)`	affected	code_commit	—
`[d40261236e8e278cb1936cb5e934262971692b10,e24eb271061db384a3c3ef6f107fe515e68ef222)`	affected	code_commit	—
`[d40261236e8e278cb1936cb5e934262971692b10,51e65f1d78457ea4f9513d90ab22c9dccbb35110)`	affected	code_commit	—
`[d40261236e8e278cb1936cb5e934262971692b10,47b6bcef6e679593d2e86e04ee72c46a4e2f7139)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.0`	affected	generic	—
`[0,3.0)`	unaffected	semver	—
`[5.10.261,5.10.*]`	unaffected	semver	—
`[5.15.212,5.15.*]`	unaffected	semver	—
`[6.1.178,6.1.*]`	unaffected	semver	—
`[6.6.145,6.6.*]`	unaffected	semver	—
`[6.12.96,6.12.*]`	unaffected	semver	—
`[6.18.39,6.18.*]`	unaffected	semver	—
`[7.1.4,7.1.*]`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the kalmia_rx_fixup bounds‑check patch.
Rebuild the kernel applying the patch if a distribution update is unavailable.
Disable Kalmia USB Ethernet devices if immediate patching cannot be performed.

Generated by OpenCVE AI on September 3, 2026 at 22:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00185.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2d04c37ed4e1d0f733ad39ec35b5a5d8818b4f4a
https://git.kernel.org/stable/c/391706889a5112feafdc0c68db3ecc7ed325d09c
https://git.kernel.org/stable/c/46ab32870d010e9a057bc5659cea22b7e728ca88
https://git.kernel.org/stable/c/47b6bcef6e679593d2e86e04ee72c46a4e2f7139
https://git.kernel.org/stable/c/51e65f1d78457ea4f9513d90ab22c9dccbb35110
https://git.kernel.org/stable/c/aa4eef2cbb66ea3dfcfc24bdce798dd78a81b54b
https://git.kernel.org/stable/c/c466097d85d52f3aa200736cb4759e66d4bbf6e3
https://git.kernel.org/stable/c/e24eb271061db384a3c3ef6f107fe515e68ef222
https://lore.kernel.org/linux-cve-announce/2026072518-CVE-2026-64351-eae1@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64351
https://www.cve.org/CVERecord?id=CVE-2026-64351

History

Thu, 03 Sep 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:3.0:-:::::: cpe:2.3:o:linux:linux_kernel:3.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:3.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:3.0:rc6:::::: cpe:2.3:o:linux:linux_kernel:3.0:rc7::::::

Thu, 30 Jul 2026 04:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-120 CWE-789

Tue, 28 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026072518-CVE-2026-64351-eae1@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64351 https://www.cve.org/CVERecord?id=CVE-2026-64351
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 27 Jul 2026 06:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120 CWE-789

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() kalmia_rx_fixup() computes usb_packet_length = skb->len - (2 * KALMIA_HEADER_LENGTH) as a u16, guarded only by a pre-loop check that skb->len is at least KALMIA_HEADER_LENGTH, which is 6. A device can deliver a short bulk-IN frame with skb->len in the 6 to 11 range, or leave a short trailing remainder on a later loop iteration. Either case underflows usb_packet_length to about 65530. That bypasses the usb_packet_length < ether_packet_length truncation path. The device-supplied ether_packet_length, a le16 up to 65535 read from header_start[2], then drives a memcmp() and the following skb_trim() and skb_pull() past the end of the rx buffer. The rx buffer is hard_mtu * 10, which is 14000 bytes. That is an out of bounds read. Require both the start and end framing headers to be present before subtracting them, on every loop iteration.
Title		net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2d04c37ed4e1d0f733ad39ec35b5a5d8818b4f4a https://git.kernel.org/stable/c/391706889a5112feafdc0c68db3ecc7ed325d09c https://git.kernel.org/stable/c/46ab32870d010e9a057bc5659cea22b7e728ca88 https://git.kernel.org/stable/c/47b6bcef6e679593d2e86e04ee72c46a4e2f7139 https://git.kernel.org/stable/c/51e65f1d78457ea4f9513d90ab22c9dccbb35110 https://git.kernel.org/stable/c/aa4eef2cbb66ea3dfcfc24bdce798dd78a81b54b https://git.kernel.org/stable/c/c466097d85d52f3aa200736cb4759e66d4bbf6e3 https://git.kernel.org/stable/c/e24eb271061db384a3c3ef6f107fe515e68ef222

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:10.882Z

Updated: 2026-08-17T04:53:56.750Z

Reserved: 2026-07-19T15:36:31.782Z

Link: CVE-2026-64351

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-25T10:17:17.407

Modified: 2026-09-03T16:03:31.400

Link: CVE-2026-64351

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64351 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-03T22:30:10Z

Weaknesses

CWE-125
Out-of-bounds Read
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object