---
id: CVE-2026-43156
title: 'net: usb: pegasus: enable basic endpoint checking'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: usb: pegasus: enable basic endpoint checking

  pegasus_probe() fills URBs with hardcoded endpoint pipes without
  verifying the endpoint descriptors:

    - usb_rcvbulk…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    a3e64e950a3981a8199de9798f6d21261b959171
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    229dc9b9db475ac900182bafe258943e0e054c6d
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    26b3ec62fa1a94ac801feca47f040fc729b3c174
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    35854ed5c40b02f95824e44398f9d2ba33727203
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    67ba6b13dbcaf45681fb6758794c5ac5fa589a6c
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    d2e7c898cc02dfe42443489a67a45ed616cb76e9
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    2705709f6574a088aab246af72fc95f2fea51484
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    3d7e6ce34f4fcc7083510c28b17a7c36462a25d4
  - Linux 2.6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:29:51.233976Z'
published: '2026-05-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:34.240Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43156'
references:
  - url: 'https://git.kernel.org/stable/c/a3e64e950a3981a8199de9798f6d21261b959171'
  - url: 'https://git.kernel.org/stable/c/229dc9b9db475ac900182bafe258943e0e054c6d'
  - url: 'https://git.kernel.org/stable/c/26b3ec62fa1a94ac801feca47f040fc729b3c174'
  - url: 'https://git.kernel.org/stable/c/35854ed5c40b02f95824e44398f9d2ba33727203'
  - url: 'https://git.kernel.org/stable/c/67ba6b13dbcaf45681fb6758794c5ac5fa589a6c'
  - url: 'https://git.kernel.org/stable/c/d2e7c898cc02dfe42443489a67a45ed616cb76e9'
  - url: 'https://git.kernel.org/stable/c/2705709f6574a088aab246af72fc95f2fea51484'
  - url: 'https://git.kernel.org/stable/c/3d7e6ce34f4fcc7083510c28b17a7c36462a25d4'
tags:
  - cve.org
epss: 0.00123
epssPercentile: 0.02059
ingestedAt: '2026-11-06T15:54:04.021Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: usb: pegasus: enable basic endpoint checking

pegasus_probe() fills URBs with hardcoded endpoint pipes without
verifying the endpoint descriptors:

  - usb_rcvbulkpipe(dev, 1) for RX data
  - usb_sndbulkpipe(dev, 2) for TX data
  - usb_rcvintpipe(dev, 3)  for status interrupts

A malformed USB device can present these endpoints with transfer types
that differ from what the driver assumes.

Add a pegasus_usb_ep enum for endpoint numbers, replacing magic
constants throughout. Add usb_check_bulk_endpoints() and
usb_check_int_endpoints() calls before any resource allocation to
verify endpoint types before use, rejecting devices with mismatched
descriptors at probe time, and avoid triggering assertion.

Similar fix to
- commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking")
- commit 9e7021d2aeae ("net: usb: catc: enable basic endpoint checking")

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a3e64e950a3981a8199de9798f6d21261b959171`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 229dc9b9db475ac900182bafe258943e0e054c6d`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 26b3ec62fa1a94ac801feca47f040fc729b3c174`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 35854ed5c40b02f95824e44398f9d2ba33727203`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 67ba6b13dbcaf45681fb6758794c5ac5fa589a6c`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d2e7c898cc02dfe42443489a67a45ed616cb76e9`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2705709f6574a088aab246af72fc95f2fea51484`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 3d7e6ce34f4fcc7083510c28b17a7c36462a25d4`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.