All vulnerabilities
CVE-2026-97540

Linux: net: usb: pegasus: don't rely on id table pointer arithmetic

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7c940a1100cb0aa18a54dc48d736c0525c0f400cAlso 05d47f540d85c8f6697ec5cfc1aa7b4f96a5b31b, 9425a13960ef38bac237608f25c9ee64ff113086 and 2 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 7c940a1100cb0aa18a54dc48d736c0525c0f400cLinuxCVE List
  • 05d47f540d85c8f6697ec5cfc1aa7b4f96a5b31bLinuxCVE List
  • 9425a13960ef38bac237608f25c9ee64ff113086LinuxCVE List
  • 7654812b65047349ea4c111eed42c4315a00e462LinuxCVE List
  • 61b84e964a829d534f24eab4cbd4035d22b52601LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: pegasus: don't rely on id table pointer arithmetic

The current code is broken when dynamic ID is involved; in such cases usb_device_id parameter of probe lives on the heap and the pointer arithmetic will get an index that is wildly out of bound. Instead of keeping a side table for additional information, use driver_info field of the usb_device_id.

The dynamic ID parsing code needs to be updated for this; convert it to just write to the reserved entry for dynamic ID and remove the weird loop.

Text from CVE List

Affected versions 14

  • Linuxaffected: 733260ff9c45bd4db60f45d17e8560a4a68dff4d before 7c940a1100cb0aa18a54dc48d736c0525c0f400cCVE List
  • Linuxaffected: 733260ff9c45bd4db60f45d17e8560a4a68dff4d before 05d47f540d85c8f6697ec5cfc1aa7b4f96a5b31bCVE List
  • Linuxaffected: 733260ff9c45bd4db60f45d17e8560a4a68dff4d before 9425a13960ef38bac237608f25c9ee64ff113086CVE List
  • Linuxaffected: 733260ff9c45bd4db60f45d17e8560a4a68dff4d before 7654812b65047349ea4c111eed42c4315a00e462CVE List
  • Linuxaffected: 733260ff9c45bd4db60f45d17e8560a4a68dff4d before 61b84e964a829d534f24eab4cbd4035d22b52601CVE List
  • Linuxaffected: 733260ff9c45bd4db60f45d17e8560a4a68dff4d before ce8101c331956bbd3e20681331dfd22eb7c1c1eaCVE List
  • Linuxaffected: 2.6.16CVE List
  • Linuxunaffected: all versions before 2.6.16CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6