CVE-2026-23365

A flaw was found in the Linux kernel's kalmia USB driver. This vulnerability occurs because the driver does not properly validate the number and types of USB endpoints when a device is connected. A local attacker with a specially crafted malicious USB device could exploit this flaw, causing the kalmia driver to crash. This leads to a Denial of Service (DoS) on the affected system.

This flaw affects systems with the kalmia USB modem driver loaded. The missing endpoint validation allows a malicious USB device to cause a crash when the driver blindly accesses expected endpoints that don't exist. Physical access to connect a USB device is required. The kalmia driver is for Samsung Kalmia-based LTE modems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the kalmia module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.