CVE-2026-64351: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64351 Overview

CVE-2026-64351 is an out-of-bounds read vulnerability in the Linux kernel's kalmia USB Ethernet driver. The flaw resides in the kalmia_rx_fixup() function within drivers/net/usb/kalmia.c, which handles incoming USB bulk-IN frames. A malicious or malformed USB device can deliver a short frame that triggers an integer underflow in the packet length calculation. The underflow bypasses a length truncation check and causes memcmp(), skb_trim(), and skb_pull() operations to read past the end of the receive buffer. The Linux kernel maintainers have addressed the issue with a patch that requires both framing headers to be present on every loop iteration.

Critical Impact
A crafted USB device can trigger an out-of-bounds read of up to 65,535 bytes against a 14,000-byte receive buffer, potentially leading to kernel information disclosure or denial of service.

Affected Products

Linux kernel versions containing the kalmia USB Ethernet driver (drivers/net/usb/kalmia.c)
Systems using Samsung Kalmia-based USB Ethernet adapters
Multiple stable kernel branches referenced by upstream fix commits

Discovery Timeline

2026-07-25 - CVE-2026-64351 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64351

Vulnerability Analysis

The vulnerability affects kalmia_rx_fixup(), the receive fixup routine invoked by the USB networking stack when a kalmia device delivers a bulk-IN frame. The function iterates over the socket buffer (skb) and expects each embedded packet to be bracketed by two 6-byte framing headers, defined as KALMIA_HEADER_LENGTH. It computes usb_packet_length = skb->len - (2 * KALMIA_HEADER_LENGTH) as a u16 value.

The pre-loop guard only validates that skb->len >= KALMIA_HEADER_LENGTH. When skb->len falls between 6 and 11 bytes, or when a short trailing remainder appears on a later loop iteration, the subtraction underflows. The u16 result wraps to approximately 65,530, defeating the subsequent usb_packet_length < ether_packet_length truncation branch.

Root Cause

The root cause is an integer underflow driven by an insufficient boundary check. The code validates only the start header before subtracting the size of both start and end headers. A device that sends a frame shorter than 2 * KALMIA_HEADER_LENGTH, or that leaves a short trailing chunk after processing valid packets, causes the length arithmetic to wrap around the unsigned 16-bit boundary.

Attack Vector

An attacker with physical access, or control over a maliciously programmed USB device, can plug in a device that identifies as a Kalmia Ethernet adapter. The device then supplies a crafted bulk-IN transfer with skb->len in the 6-to-11 byte range, or arranges a short trailing remainder in a multi-packet frame. The device also controls the ether_packet_length field, a little-endian 16-bit value read from header_start[2], which can be set as high as 65,535. Because the truncation check is bypassed, memcmp(), skb_trim(), and skb_pull() operate using the attacker-controlled length against the fixed 14,000-byte (hard_mtu * 10) receive buffer, producing an out-of-bounds read.

See the upstream commits, including Kernel Commit 391706889a51 and Kernel Commit 2d04c37ed4e1, for the patch that requires both framing headers to be present before performing the length subtraction on every iteration.

Detection Methods for CVE-2026-64351

Indicators of Compromise

Kernel log entries referencing kalmia or kalmia_rx_fixup with unexpected receive lengths or truncated frame warnings
USB device insertion events for unfamiliar Ethernet-class devices, particularly those identifying with Kalmia-compatible USB vendor and product IDs
KASAN or slab-out-of-bounds reports implicating kalmia_rx_fixup in the call stack

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface out-of-bounds reads originating from USB network drivers
Correlate udev and kernel ring buffer events for unexpected kalmia module loads on production endpoints
Audit installed kernel versions against the fixed commits published on git.kernel.org to identify unpatched hosts

Monitoring Recommendations

Forward dmesg, journald, and auditd USB subsystem events to a central log store for anomaly review
Alert on new USB Ethernet adapter enumeration on systems where such devices are not expected
Track kernel package versions across the fleet to confirm timely uptake of stable kernel updates

How to Mitigate CVE-2026-64351

Immediate Actions Required

Update to a Linux kernel build that includes the upstream kalmia_rx_fixup() bounds fix from the referenced stable commits
Restrict physical access to systems and disable unused USB ports on servers and shared workstations
Blacklist the kalmia kernel module on systems that do not require Samsung Kalmia USB Ethernet support

Patch Information

The fix requires both the start and end framing headers to be present before subtracting them, on every loop iteration. Distribution kernels should pick up the change from stable branches through commits including Kernel Commit 391706889a51, Kernel Commit 47b6bcef6e67, Kernel Commit c466097d85d5, Kernel Commit 51e65f1d7845, Kernel Commit aa4eef2cbb66, Kernel Commit 46ab32870d01, Kernel Commit e24eb271061d, and Kernel Commit 2d04c37ed4e1.

Workarounds

Blacklist the driver by adding blacklist kalmia to /etc/modprobe.d/ configuration on hosts without a legitimate need for the driver
Enforce USB device allow-listing via USBGuard or similar controls to block unknown Ethernet-class devices
Physically disable or lock down USB ports on high-value systems until patches are deployed

bash

# Blacklist the kalmia driver on systems that do not require it
echo 'blacklist kalmia' | sudo tee /etc/modprobe.d/blacklist-kalmia.conf
sudo modprobe -r kalmia 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep kalmia