net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()

...

CVE-2026-64351

CVE-2026-64351 affects the kalmia USB network driver in the Linux kernel. In kalmia_rx_fixup(), usb_packet_length is computed as a u16 by subtracting two header lengths from skb->len. A device delivering a short bulk-IN frame (length 6–11) or a short trailing remainder causes an underflow to ~...

CVE-2026-64351

In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmiarxfixup kalmiarxfixup computes usbpacketlength = skb-len - 2 KALMIAHEADERLENGTH as a u16, guarded only by a pre-loop check that skb-len is at least KALMIAHEADERLENGTH, which is 6. ...

EUVD-2026-48895

In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmiarxfixup kalmiarxfixup computes usbpacketlength = skb-len - 2 KALMIAHEADERLENGTH as a u16, guarded only by a pre-loop check that skb-len is at least KALMIAHEADERLENGTH, which is 6. ...