CVE-2026-64351

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()<br /> <br /> kalmia_rx_fixup() computes usb_packet_length = skb-&gt;len - (2 *<br /> KALMIA_HEADER_LENGTH) as a u16, guarded only by a pre-loop check that<br /> skb-&gt;len is at least KALMIA_HEADER_LENGTH, which is 6. A device can<br /> deliver a short bulk-IN frame with skb-&gt;len in the 6 to 11 range, or<br /> leave a short trailing remainder on a later loop iteration. Either case<br /> underflows usb_packet_length to about 65530.<br /> <br /> That bypasses the usb_packet_length