CVE-2026-23290: Linux Kernel Pegasus Driver DoS Flaw

CVE-2026-23290 Overview

A vulnerability has been identified in the Linux kernel's pegasus USB network driver where USB endpoint validation is missing during device probing. The driver fails to verify that a connecting USB device has the proper number and types of USB endpoints before binding to it. This missing validation allows a malicious or malformed USB device to cause a kernel crash when the driver attempts to access non-existent USB endpoints.

Critical Impact
A malicious USB device without the expected USB Request Blocks (URBs) can cause the pegasus driver to crash the kernel when it blindly accesses non-existent endpoints, potentially leading to denial of service.

Affected Products

Linux kernel (versions with vulnerable pegasus USB network driver)
Systems using Pegasus USB-to-Ethernet adapters
Embedded Linux devices with USB networking support

Discovery Timeline

2026-03-25 - CVE CVE-2026-23290 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23290

Vulnerability Analysis

The vulnerability exists within the Linux kernel's pegasus USB network driver, which provides support for USB-to-Ethernet adapters based on ADMtek Pegasus chipsets. The core issue stems from insufficient input validation during the device probing phase.

When a USB device is connected and identified as a potential Pegasus-compatible adapter, the driver proceeds to bind to the device without first verifying that the device has the correct number and types of USB endpoints. USB endpoints are essential communication channels between the host system and the USB device, and the pegasus driver expects specific bulk and interrupt endpoints for proper operation.

Without proper endpoint validation, if a malicious or malformed USB device is connected that lacks the expected endpoint configuration, the driver will proceed with initialization and later attempt to access these non-existent endpoints. This results in null pointer dereferences or access to invalid memory regions, causing a kernel crash (panic/oops).

Root Cause

The root cause is an improper input validation vulnerability in the pegasus driver's probe function. The driver makes assumptions about the USB device's endpoint configuration without verification. Specifically, the driver does not check whether the required bulk-in, bulk-out, and interrupt endpoints exist before storing and using references to them.

This represents a failure to follow secure coding practices for USB drivers, which should always validate that attached devices conform to expected specifications before binding.

Attack Vector

The attack requires physical access to a target system with a USB port. An attacker can craft a malicious USB device that identifies itself as a Pegasus-compatible adapter but lacks the proper endpoint configuration. Upon connection, the Linux kernel's pegasus driver will bind to the device and subsequently crash when attempting to use the missing endpoints.

This attack falls under the category of "BadUSB" style attacks where malicious hardware can compromise or disrupt a system. The attack does not require authentication or user interaction beyond physical USB device connection.

Detection Methods for CVE-2026-23290

Indicators of Compromise

Kernel panic or oops messages referencing the pegasus driver module
System crashes occurring immediately after USB device connection events
Kernel logs showing null pointer dereferences in drivers/net/usb/pegasus.c
Unexpected USB device enumeration events for Pegasus-compatible device IDs

Detection Strategies

Monitor kernel logs (dmesg, /var/log/kern.log) for pegasus driver errors and null pointer dereferences
Implement USB device monitoring to detect unexpected Pegasus-compatible device connections
Deploy endpoint detection solutions capable of monitoring USB device attachments and kernel module behavior
Use audit rules to track USB device plug events and correlate with system stability issues

Monitoring Recommendations

Enable kernel panic logging and crash dump collection for forensic analysis
Configure USB device whitelisting to restrict connections to known trusted devices
Monitor for repeated system reboots or kernel crashes that may indicate exploitation attempts

How to Mitigate CVE-2026-23290

Immediate Actions Required

Update the Linux kernel to a patched version containing the endpoint validation fix
Consider disabling or blacklisting the pegasus kernel module if not required: echo "blacklist pegasus" >> /etc/modprobe.d/blacklist.conf
Restrict physical access to USB ports on critical systems
Implement USB device authorization policies to prevent unauthorized device connections

Patch Information

The Linux kernel developers have released patches to address this vulnerability by adding proper USB endpoint validation in the pegasus driver probe function. Multiple commits have been applied to various stable kernel branches:

The fix adds validation checks to ensure the device has the required bulk and interrupt endpoints before the driver proceeds with binding. If validation fails, the probe function returns an error and the driver does not bind to the device.

Workarounds

Blacklist the pegasus module to prevent it from loading if Pegasus USB network adapters are not required
Use USB device authorization to require manual approval for new USB devices
Implement physical security controls to prevent unauthorized USB device connections
Deploy USB port blockers on systems where USB networking is not needed

bash

# Configuration example - Blacklist pegasus module
echo "blacklist pegasus" | sudo tee /etc/modprobe.d/blacklist-pegasus.conf
sudo update-initramfs -u

# Disable USB device auto-authorization (requires manual authorization)
echo 0 | sudo tee /sys/bus/usb/devices/usb*/authorized_default