{"id":"CVE-2026-97540","revision":"40e4728ee17d4a5d9f019c732cb0043c","records":[{"revision":"40e4728ee17d4a5d9f019c732cb0043c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-97540","aliases":[],"title":"net: usb: pegasus: don't rely on id table pointer arithmetic","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: don't rely on id table pointer arithmetic\n\nThe current code is broken when dynamic ID is involved; in such cases\nusb_device_id parameter of probe lives on the heap and the pointer\narithmetic will get an index that is wildly out of bound. Instead of\nkeeping a side table for additional information, use driver_info field of\nthe usb_device_id.\n\nThe dynamic ID parsing code needs to be updated for this; convert it to\njust write to the reserved entry for dynamic ID and remove the weird loop.","state":0,"publishedAt":"2026-09-25T10:21:37.41+00:00","modifiedAt":"2026-10-19T09:09:02.51+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/usb/pegasus.c\",\n                        \"drivers/net/usb/pegasus.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"733260ff9c45bd4db60f45d17e8560a4a68dff4d\",\n                            \"lessThan\": \"7c940a1100cb0aa18a54dc48d736c0525c0f400c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"733260ff9c45bd4db60f45d17e8560a4a68dff4d\",\n                            \"lessThan\": \"05d47f540d85c8f6697ec5cfc1aa7b4f96a5b31b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"733260ff9c45bd4db60f45d17e8560a4a68dff4d\",\n                            \"lessThan\": \"9425a13960ef38bac237608f25c9ee64ff113086\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"733260ff9c45bd4db60f45d17e8560a4a68dff4d\",\n                            \"lessThan\": \"7654812b65047349ea4c111eed42c4315a00e462\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"733260ff9c45bd4db60f45d17e8560a4a68dff4d\",\n                            \"lessThan\": \"61b84e964a829d534f24eab4cbd4035d22b52601\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"733260ff9c45bd4db60f45d17e8560a4a68dff4d\",\n                            \"lessThan\": \"ce8101c331956bbd3e20681331dfd22eb7c1c1ea\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/usb/pegasus.c\",\n                        \"drivers/net/usb/pegasus.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/7c940a1100cb0aa18a54dc48d736c0525c0f400c","https://git.kernel.org/stable/c/05d47f540d85c8f6697ec5cfc1aa7b4f96a5b31b","https://git.kernel.org/stable/c/9425a13960ef38bac237608f25c9ee64ff113086","https://git.kernel.org/stable/c/7654812b65047349ea4c111eed42c4315a00e462","https://git.kernel.org/stable/c/61b84e964a829d534f24eab4cbd4035d22b52601","https://git.kernel.org/stable/c/ce8101c331956bbd3e20681331dfd22eb7c1c1ea"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97540","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-97540","identifiers":["CVE-2026-97540"]},"retained":false,"historicalAffected":[]}],"coverage":[]}