CVE-2026-64351

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the kalmia rx fixup() function. The function calculates usb packet length by subtracting twice the KALMIA HEADER LENGTH from skb->len. Because the pre-loop check only ensures skb->len is at least 6, a device can provide a short bulk-IN frame (length 6 to 11) or a short trailing remainder, causing usb packet length to underflow to approximately 65530. This underflow bypasses the truncation path, allowing a device-supplied ether packet length (up to 65535) to drive memcmp(), skb trim(), and skb pull() beyond the end of the 14000-byte rx buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.