CVE-2026-45923

A flaw was found in the Linux kernel's net: usb: catc driver. A malformed Universal Serial Bus (USB) device can present endpoint descriptors with transfer types that differ from what the driver expects. This can lead to the driver attempting to use incorrect endpoint types, potentially causing unexpected behavior or resource exhaustion within the kernel. The vulnerability is resolved by adding checks to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.