Junglewise Threat Intelligence

CVE-2026-43375: Linux Kernel MCTP device leak in USB transport driver

CVE-2026-43375 · Severity: info · Published 2026-05-08

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's MCTP (Management Component Transport Protocol) USB driver could lead to a memory leak. This occurs because the system fails to properly release hardware references when a device connection attempt fails. Over time, such leaks can degrade system performance or lead to instability, potentially impacting the availability of services relying on MCTP communication.

Technical details

A resource leak exists in drivers/net/mctp/mctp-usb.c within the Linux kernel. The mctp_usb_probe function incorrectly takes an additional reference to the USB device using usb_get_dev() but fails to release it if the probe process subsequently fails. Since the driver core already maintains a reference to the USB interface and its parent device while bound, the extra reference was redundant and caused a leak. An attacker with the ability to trigger repeated probe failures (e.g., via physical device manipulation or local driver interaction) could potentially cause a denial-of-service through memory exhaustion. The issue has been resolved by removing the redundant reference increment.

Affected products

  • Linux Linux Kernel 6.15

Timeline

  • 2026-03-05: patched: Initial patch authored by Johan Hovold
  • 2026-05-08: disclosed: CVE-2026-43375 published

References

Related threats