5.5

CVE-2026-45923: linux

CVSS: 5.5v3.1MediumUndergoing analysis
AliasesUBUNTU-CVE-2026-45923DEBIAN-CVE-2026-45923
Published 27-05-2026Last modified 27-05-2026
Open JSON

Vulnerability summary

CVE-2026-45923 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 5.1% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.16%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 25 · Related 25
OPENSUSE-SU-2026:21555-1SUSE-SU-2026:23066-1SUSE-SU-2026:23068-1SUSE-SU-2026:23193-1SUSE-SU-2026:23194-1SUSE-SU-2026:23221-1

Timeline

  1. 27-05-2026
    PublishedVulnerability first disclosed.

Description

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: enable basic endpoint checking catc_probe() fills three URBs with hardcoded endpoint pipes without verifying the endpoint descriptors: - usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX - usb_rcvintpipe(usbdev, 2) for interrupt status A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes. Add a catc_usb_ep enum for endpoint numbers, replacing magic constants throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls after usb_set_interface() to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time. Similar to - commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking") which fixed the issue in rtl8150.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

0.16%

Chance of exploitation in the next 30 days

Percentile

5%

Versus all other CVEs

30-day change

0.00 pp

From 0.16% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.16%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu157 products
  • linuxAll versions (No fix recorded) | < 6.8.0-134.134
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 6.8.0-1060.63
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < eade522d3e6ac3f3bfb51bfa5b5b4b32bd0b846f | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < ac7739b78ded519e1d9919a814da3b34120bec8c | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 163d04897e57633c5d2e69734e4e4b22bb63f50d | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < a488001a8197da4f9c413eec8f6acbff71c60145 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 36c28b028efba0f42218d41fed12c47ce217c1f1 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 1a42cfced8900d33d032c7ec338484855b61b8cc | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 9e7021d2aeae57c323a6f722ed7915686cdcc123 | 2.6.12
  • linux_kernel≥ 2.6.12.1, < 5.10.252 | ≥ 5.11, < 6.1.165 | ≥ 6.2, < 6.6.128 | ≥ 6.7, < 6.12.75 | ≥ 6.13, < 6.18.14 | ≥ 6.19, < 6.19.4 | 2.6.12 | 2.6.12:rc2 | 2.6.12:rc3 | 2.6.12:rc4 | 2.6.12:rc5
Debian1 product
  • linux< 6.1.170-1 | < 6.12.85-1 | < 6.18.14-1

3 vendors · 160 products

References

23 links
Show all 23 references