Executive brief
A synchronization vulnerability was identified in the Linux kernel's USB dummy host controller driver (dummy-hcd). This component is used to emulate USB hardware for testing and development. An exploit could allow a local user to cause a system crash or potentially gain unauthorized access to sensitive data by triggering a race condition during the disconnection of emulated USB devices.
Technical details
A race condition exists in the Linux kernel's dummy-hcd driver due to an incorrect sequence in the emulated interrupt-disable and synchronization logic. Specifically, the emulated synchronize_irq() was occurring before the emulated interrupt-disable flag was set. This allowed new emulated interrupts to be triggered after the synchronization check had already passed, potentially resulting in a callback handler running while the gadget driver was being unbound. This vulnerability is classified as a race condition that can lead to use-after-free or general protection faults. The fix involves moving the synchronization code to the dummy_udc_async_callbacks() routine to ensure interrupts are fully disabled before waiting for active callbacks to complete.
Affected products
- Linux Linux Kernel All versions prior to the fix in dummy-hcd driver
Timeline
- 2026-03-15: patched: Initial fix authored by Alan Stern
- 2026-05-08: disclosed: CVE-2026-43324 published
References
- https://git.kernel.org/stable/c/2ca9e46f8f1f5a297eb0ac83f79d35d5b3a02541
- https://git.kernel.org/stable/c/5687a09776069bd915560021c9728ca528440128
- https://git.kernel.org/stable/c/5aa776c8615bea3b1eaeec87b0788375800ead4f
- https://git.kernel.org/stable/c/8bcd80219d8e10e660bf29b20e41bb8beb4e4cb7
- https://git.kernel.org/stable/c/94d4fab1dd9e64f45449bcc7d6a5acf796b13015
- https://git.kernel.org/stable/c/cbf7df5e5d27cd5bea92ee9a75a4b28dbcc718d4
- https://git.kernel.org/stable/c/d847f375b1bcea713143bc02720d13d2d01b012a