CVE-2026-97540

A flaw was found in the Linux kernel's Pegasus USB Ethernet driver. This vulnerability can lead to a Denial of Service (DoS) through a system crash. When dynamic device identifiers are configured, the driver improperly uses pointer calculations on heap memory instead of referencing its static device table. A local user can trigger an out-of-bounds memory read during device probing, resulting in system instability.

A denial-of-service flaw of moderate impact was found in the Pegasus USB Ethernet adapter driver (drivers/net/usb/pegasus.c) in the Linux kernel as shipped with Red Hat Enterprise Linux, RHEL Real Time, RHEL for Edge/IVOS, and OpenShift RHEL CoreOS. When dynamic USB device identifiers are configured for the driver, the probe routine derives an entry index by performing pointer arithmetic on the heap-allocated usb_device_id structure instead of using the driver's static device-ID table. The resulting index can be wildly out of bounds, causing an out-of-bounds memory read during device probing. A local user who can trigger probing of a device matching a configured dynamic ID can use this flaw to crash the kernel and cause a denial of service; confidentiality and integrity are not affected (Red Hat CVSS 3.1 score 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The currently affected Red Hat products and streams (RHEL 7, 8, 9, and 10, including Real Time, Edge, and IVOS variants, and OpenShift RHEL CoreOS 4.12 through 5.1) are recorded as affected with the fix deferred; the RHEL 6 ELS stream is out of support scope. Because the issue is reachable only through local access on systems where dynamic device IDs are configured for this driver and the impact is limited to availability, the residual risk of the deferred fix is a local kernel crash and resulting system instability on such configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The flaw is only triggered when dynamic device IDs are configured for the pegasus driver. Avoid adding dynamic USB device IDs for this driver (for example, do not use the new_id interface of the pegasus driver), so that device probing uses only the driver's static device-ID table. If Pegasus-based USB Ethernet adapters are not required on the system, the vulnerable code path can also be avoided by not loading the pegasus kernel module (for example, by blacklisting it).