CVE-2026-43156 net: usb: pegasus: enable basic endpoint checking
A malicious USB device can cause a denial of service in the Linux kernel pegasus driver by presenting mismatched endpoint descriptors.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43156?
CVE-2026-43156 is a medium-severity denial of service vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: usb: pegasus: enable basic endpoint checking
pegasus_probe() fills URBs with hardcoded endpoint pipes without verifying the endpoint descriptors:
- usb_rcvbulkpipe(dev, 1) for RX data - usb_sndbulkpipe(dev, 2) for TX data - usb_rcvintpipe(dev, 3) for status interrupts
A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes.
Add a pegasus_usb_ep enum for endpoint numbers, replacing magic constants throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls before any resource allocation to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time, and avoid triggering assertion.
Similar fix to - commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking") - commit 9e7021d2aeae ("net: usb: catc: enable basic endpoint checking")
Which versions are affected by CVE-2026-43156?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43156?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-43156 being exploited?
There is no known exploitation of CVE-2026-43156 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43156, DEBIAN-CVE-2026-43156, GHSA-4pc7-q2m2-j888, ROOT-OS-DEBIAN-11-CVE-2026-43156, ROOT-OS-UBUNTU-2204-CVE-2026-43156, ROOT-OS-UBUNTU-2404-CVE-2026-43156 and 1 more.