-

CVE-2026-97540

net: usb: pegasus: don't rely on id table pointer arithmetic

In the Linux kernel, the following vulnerability has been resolved:

net: usb: pegasus: don't rely on id table pointer arithmetic

The current code is broken when dynamic ID is involved; in such cases
usb_device_id parameter of probe lives on the heap and the pointer
arithmetic will get an index that is wildly out of bound. Instead of
keeping a side table for additional information, use driver_info field of
the usb_device_id.

The dynamic ID parsing code needs to be updated for this; convert it to
just write to the reserved entry for dynamic ID and remove the weird loop.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 733260ff9c45bd4db60f45d17e8560a4a68dff4d
Version < 7c940a1100cb0aa18a54dc48d736c0525c0f400c
Status affected
Version 733260ff9c45bd4db60f45d17e8560a4a68dff4d
Version < 05d47f540d85c8f6697ec5cfc1aa7b4f96a5b31b
Status affected
Version 733260ff9c45bd4db60f45d17e8560a4a68dff4d
Version < 9425a13960ef38bac237608f25c9ee64ff113086
Status affected
Version 733260ff9c45bd4db60f45d17e8560a4a68dff4d
Version < 7654812b65047349ea4c111eed42c4315a00e462
Status affected
Version 733260ff9c45bd4db60f45d17e8560a4a68dff4d
Version < 61b84e964a829d534f24eab4cbd4035d22b52601
Status affected
Version 733260ff9c45bd4db60f45d17e8560a4a68dff4d
Version < ce8101c331956bbd3e20681331dfd22eb7c1c1ea
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 2.6.16
Status affected
Version 0
Version < 2.6.16
Status unaffected
Version <= 6.1.*
Version 6.1.189
Status unaffected
Version <= 6.6.*
Version 6.6.158
Status unaffected
Version <= 6.12.*
Version 6.12.111
Status unaffected
Version <= 6.18.*
Version 6.18.53
Status unaffected
Version <= 7.2.*
Version 7.2.7
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.088
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/9425a13960ef38bac237608f25c9ee64ff113086
https://git.kernel.org/stable/c/7654812b65047349ea4c111eed42c4315a00e462
https://git.kernel.org/stable/c/61b84e964a829d534f24eab4cbd4035d22b52601
https://git.kernel.org/stable/c/ce8101c331956bbd3e20681331dfd22eb7c1c1ea
https://git.kernel.org/stable/c/05d47f540d85c8f6697ec5cfc1aa7b4f96a5b31b
https://git.kernel.org/stable/c/7c940a1100cb0aa18a54dc48d736c0525c0f400c