Linux Kernel EUVD-2026-48895

The kalmia driver (drivers/net/usb/kalmia.c) handles Samsung Kalmia-based USB LTE network adapters. In kalmia_rx_fixup(), each received frame is expected to carry two 6-byte framing headers (KALMIA_HEADER_LENGTH = 6). The function computes usb_packet_length as a u16 by subtracting 12 from skb->len, but the pre-loop guard checks only that skb->len >= 6 (one header), not >= 12 (both headers). A device delivering a frame with skb->len in the range 6-11, or a short trailing remainder in a later loop iteration, causes the u16 subtraction to underflow to approximately 65,530. This inflated value bypasses the usb_packet_length < ether_packet_length truncation path. The device-supplied ether_packet_length - a little-endian u16 up to 65,535 read from header_start[2] - then steers memcmp(), skb_trim(), and skb_pull() beyond the statically sized RX buffer (hard_mtu * 10 = 14,000 bytes), resulting in an out-of-bounds read. The root cause is CWE-191 (Integer Underflow / Wrap-around) compounded by insufficient per-iteration input validation of attacker-controlled USB frame lengths. The fix enforces that both framing headers are present on every loop iteration before subtracting their combined length.