Junglewise Threat Intelligence

CVE-2026-43424: Linux Kernel NULL pointer dereference in USB gadget f_tcm

CVE-2026-43424 · Severity: medium · CVSS 5.5 · Published 2026-05-08

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's USB gadget driver could allow a connected USB device to crash the system. The affected component manages how the computer acts as a USB peripheral (like a storage drive). By sending specific commands at the wrong time, a malicious or malfunctioning USB host can trigger a system-wide crash (kernel panic), leading to a denial of service.

Technical details

A race condition exists in the f_tcm (USB Target) driver within the Linux kernel's USB gadget subsystem. The `tpg->tpg_nexus` pointer, which is managed via ConfigFS, can be NULL if a USB host sends requests before the nexus is fully established or after it is dropped. Functions such as `bot_submit_command()` and related data transfer paths fail to validate this pointer before dereferencing it. An attacker with the ability to send Bulk-Only Transport (BOT) commands can trigger a NULL pointer dereference, resulting in a kernel panic. The fix introduces necessary NULL checks in the command processing paths to gracefully abort requests when the nexus is missing.

Affected products

  • Linux Linux Kernel All versions prior to the fixed stable releases

Timeline

  • 2026-05-08: advisory: CVE-2026-43424 published by kernel.org
  • 2026-03-25: patched: Fix committed to stable kernel trees

References

Related threats