Executive brief
A vulnerability in the Linux kernel's USB gadget driver could allow a connected USB device to crash the system. The affected component manages how the computer acts as a USB peripheral (like a storage drive). By sending specific commands at the wrong time, a malicious or malfunctioning USB host can trigger a system-wide crash (kernel panic), leading to a denial of service.
Technical details
A race condition exists in the f_tcm (USB Target) driver within the Linux kernel's USB gadget subsystem. The `tpg->tpg_nexus` pointer, which is managed via ConfigFS, can be NULL if a USB host sends requests before the nexus is fully established or after it is dropped. Functions such as `bot_submit_command()` and related data transfer paths fail to validate this pointer before dereferencing it. An attacker with the ability to send Bulk-Only Transport (BOT) commands can trigger a NULL pointer dereference, resulting in a kernel panic. The fix introduces necessary NULL checks in the command processing paths to gracefully abort requests when the nexus is missing.
Affected products
- Linux Linux Kernel All versions prior to the fixed stable releases
Timeline
- 2026-05-08: advisory: CVE-2026-43424 published by kernel.org
- 2026-03-25: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/2a2ef846a54a06c33b5c2d4b0d918583e1e7c0b7
- https://git.kernel.org/stable/c/3d309b37633c4a847fc149939a2c9576f1aa1065
- https://git.kernel.org/stable/c/679d9535aeb15c10bce89c44102004b96624d706
- https://git.kernel.org/stable/c/b9b26d7f3aa288cfa54a7bc68612bab1f153f156
- https://git.kernel.org/stable/c/b9fde507355342a2d64225d582dc8b98ff5ecb19
- https://git.kernel.org/stable/c/d146f27758049fa55ae4c53785a852d3cf7a18d6
- https://git.kernel.org/stable/c/f962ca3b020e13d6714f27e8c36fe742441c58d1