net: usb: pegasus: validate USB endpoints (CVE-2026-23290) | HOL Guard CVE