CVE-2026-64351

A flaw was found in the Linux kernel's USB Kalmia driver. An attacker with a specially crafted USB device could exploit an out-of-bounds read vulnerability in the kalmia_rx_fixup() function. This occurs due to an incorrect calculation of the USB packet length when processing short bulk-IN frames, leading to a memory underflow. This flaw could allow an attacker to read sensitive information from outside the intended memory buffer or potentially cause a denial of service.

A malformed RX frame in the USB Kalmia network driver can make kalmia_rx_fixup compute usb_packet_length from a buffer that contains only one framing header or a short trailing remainder. The subtraction can underflow a u16 length and lets a device supplied ether_packet_length drive an out-of-bounds read in the receive path. For the CVSS the PR:N because the attacker does not need an account on the host when controlling a malicious or compromised USB modem. The issue is not directly reachable over IP network traffic and normally requires a malicious attached USB device or compromised modem firmware. Impact is primarily denial of service via kernel crash. For the paranoid score, limited confidentiality impact is kept because the primitive is an out-of-bounds read, but there is no clear write primitive or supported privilege escalation path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.