Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-25T00:00:00 kernel: net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-125

In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() kalmia_rx_fixup() computes usb_packet_length = skb->len - (2 * KALMIA_HEADER_LENGTH) as a u16, guarded only by a pre-loop check that skb->len is at least KALMIA_HEADER_LENGTH, which is 6. A device can deliver a short bulk-IN frame with skb->len in the 6 to 11 range, or leave a short trailing remainder on a later loop iteration. Either case underflows usb_packet_length to about 65530. That bypasses the usb_packet_length < ether_packet_length truncation path. The device-supplied ether_packet_length, a le16 up to 65535 read from header_start[2], then drives a memcmp() and the following skb_trim() and skb_pull() past the end of the rx buffer. The rx buffer is hard_mtu * 10, which is 14000 bytes. That is an out of bounds read. Require both the start and end framing headers to be present before subtracting them, on every loop iteration.

A flaw was found in the Linux kernel's USB Kalmia driver. An attacker with a specially crafted USB device could exploit an out-of-bounds read vulnerability in the `kalmia_rx_fixup()` function. This occurs due to an incorrect calculation of the USB packet length when processing short bulk-IN frames, leading to a memory underflow. This flaw could allow an attacker to read sensitive information from outside the intended memory buffer or potentially cause a denial of service.

Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Fix deferred kernel Red Hat Enterprise Linux 7 Fix deferred kernel-rt Red Hat Enterprise Linux 8 Fix deferred kernel Red Hat Enterprise Linux 8 Fix deferred kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt Red Hat Hardened Images Not affected erlang27 https://www.cve.org/CVERecord?id=CVE-2026-64351 https://nvd.nist.gov/vuln/detail/CVE-2026-64351 https://lore.kernel.org/linux-cve-announce/2026072518-CVE-2026-64351-eae1@gregkh/T