CVE-2026-43156

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: pegasus: enable basic endpoint checking

pegasus_probe() fills URBs with hardcoded endpoint pipes without

verifying the endpoint descriptors:

- usb_rcvbulkpipe(dev, 1) for RX data

- usb_sndbulkpipe(dev, 2) for TX data

- usb_rcvintpipe(dev, 3) for status interrupts

A malformed USB device can present these endpoints with transfer types

that differ from what the driver assumes.

Add a pegasus_usb_ep enum for endpoint numbers, replacing magic

constants throughout. Add usb_check_bulk_endpoints() and

usb_check_int_endpoints() calls before any resource allocation to

verify endpoint types before use, rejecting devices with mismatched

descriptors at probe time, and avoid triggering assertion.

Similar fix to

- commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking")

- commit 9e7021d2aeae ("net: usb: catc: enable basic endpoint checking")

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References