CVE-2026-45923: Linux Kernel catc USB Driver Vulnerability

CVE-2026-45923 Overview

CVE-2026-45923 is a Linux kernel vulnerability in the catc USB Ethernet driver. The driver's catc_probe() function creates three USB Request Blocks (URBs) using hardcoded endpoint pipes without validating the endpoint descriptors. A malformed USB device can present endpoints with transfer types that differ from what the driver assumes, leading to unsafe operations on mismatched endpoint types.

The issue affects the net/usb/catc driver in the Linux kernel networking subsystem. Kernel maintainers resolved the flaw by adding usb_check_bulk_endpoints() and usb_check_int_endpoints() calls after usb_set_interface(), rejecting devices with mismatched descriptors at probe time.

Critical Impact
An attacker with physical access who connects a malicious or malformed USB device can trigger driver misbehavior when the kernel binds to mismatched endpoint descriptors.

Affected Products

Linux kernel net/usb/catc driver (CATC EL1210A NIC USB Ethernet adapter)
Multiple stable Linux kernel branches receiving backported fixes
Systems with the catc driver compiled and USB device probing enabled

Discovery Timeline

2026-05-27 - CVE-2026-45923 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45923

Vulnerability Analysis

The catc driver implements support for CATC EL1210A USB Ethernet adapters. During device probing, catc_probe() populates three URBs with fixed pipe values: usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for transmit and receive paths, plus usb_rcvintpipe(usbdev, 2) for interrupt status reporting.

The driver does not verify that endpoint 1 is actually a bulk endpoint or that endpoint 2 is actually an interrupt endpoint. A USB device can advertise endpoint descriptors that contradict these assumptions. When the kernel later submits URBs against endpoints whose transfer types do not match the pipe constructor, the USB core can mishandle the requests, leading to driver state corruption or warnings from the USB subsystem.

This pattern mirrors an earlier fix in the rtl8150 driver under commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking"). The class of issue affects multiple legacy USB Ethernet drivers that pre-date the introduction of helper functions for endpoint validation.

Root Cause

The root cause is missing input validation of USB endpoint descriptors at probe time. The driver trusts that a device claiming the supported vendor and product identifiers also implements the expected endpoint topology. Malicious or malformed USB devices break that assumption.

Attack Vector

Exploitation requires the ability to attach a USB device to a vulnerable host. The attacker controls the device's descriptors and can craft endpoint metadata that does not match the transfer types the catc driver hardcodes. No verified public proof-of-concept code is available for this issue. See the upstream kernel commits referenced below for the exact patch content.

Relevant fix commits include Kernel Git Commit 163d048, Kernel Git Commit 1a42cfc, and Kernel Git Commit 9e7021d.

Detection Methods for CVE-2026-45923

Indicators of Compromise

Kernel log entries from the USB core warning about transfer type mismatches involving the catc driver
Unexpected catc driver probe failures or rejected device binds after applying the patch
Presence of unknown or rapidly enumerating USB devices in dmesg on hosts that do not normally use USB Ethernet adapters

Detection Strategies

Inventory hosts where the catc kernel module is built or loaded and compare running kernel versions against the patched stable branches
Monitor host telemetry for USB device insertion events on servers, kiosks, and industrial systems where physical access is constrained
Correlate udev and kernel ring buffer events to flag drivers rejecting devices due to mismatched endpoint descriptors

Monitoring Recommendations

Forward dmesg and journald USB subsystem messages to a centralized log platform for review
Alert on new USB vendor and product identifier pairs binding to networking drivers on production systems
Track kernel package versions across the fleet and report hosts still running pre-patch builds

How to Mitigate CVE-2026-45923

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution vendor that includes the catc endpoint validation fix
Disable or blacklist the catc kernel module on systems that do not require CATC USB Ethernet adapters
Restrict physical USB access on servers, embedded devices, and other systems where untrusted USB connections are not part of normal operations

Patch Information

The fix introduces a catc_usb_ep enum, replaces magic endpoint constants, and calls usb_check_bulk_endpoints() and usb_check_int_endpoints() after usb_set_interface() to reject devices with mismatched descriptors. Patch references include Kernel Git Commit 36c28b0, Kernel Git Commit a488001, Kernel Git Commit ac7739b, and Kernel Git Commit eade522.

Workarounds

Add catc to the kernel module blacklist on hosts that do not need CATC USB Ethernet support
Use USB port control policies such as USBGuard to allow only known-good devices to bind to host drivers
Apply physical security controls to prevent attachment of untrusted USB devices to sensitive systems

bash

# Blacklist the catc module to prevent it from loading
echo 'blacklist catc' | sudo tee /etc/modprobe.d/blacklist-catc.conf
sudo update-initramfs -u
# Verify the module is not currently loaded
lsmod | grep catc