Executive brief
A vulnerability was identified in the Linux kernel's mdc800 camera driver. When the system attempts to read data from a connected device and that device fails to respond in time, the system does not properly clean up the communication request. This can lead to system instability or crashes (kernel warnings) if subsequent read attempts are made, potentially allowing a local user to cause a denial-of-service condition.
Technical details
A vulnerability in the mdc800 USB camera driver (drivers/usb/image/mdc800.c) stems from improper timeout handling in mdc800_device_read(). The function submits a download_urb and waits for completion via wait_event_timeout(). If a timeout occurs, the function returns without calling usb_kill_urb(), leaving the URB active in the USB core. A subsequent read() call then attempts to resubmit the same URB while it is still in-flight, triggering a 'URB submitted while active' warning in usb_submit_urb(). This state inconsistency can lead to kernel instability. The fix involves checking the return value of wait_event_timeout() and explicitly killing the URB if a timeout is detected.
Affected products
- Linux Linux Kernel mdc800 driver
Timeline
- 2026-02-09: other: Patch authored by Ziyi Guo
- 2026-02-25: patched: Initial patch committed to stable tree
- 2026-05-08: disclosed: CVE-2026-43425 published
References
- https://git.kernel.org/stable/c/15536f6c15f48037a1672cbdea53266d67861ff6
- https://git.kernel.org/stable/c/155f471e38aa516f6c58c2ae03ca3dc222fa2fdb
- https://git.kernel.org/stable/c/1be3b77de4eb89af8ae2fd6610546be778e25589
- https://git.kernel.org/stable/c/9bf877cc67309b2a063b0087c3ad8585fb11cec3
- https://git.kernel.org/stable/c/9fa5a49760979ba016506fe292a431c8b83f043e
- https://git.kernel.org/stable/c/b7fed917f84e484e06c5e9926746d0b524e3a93e
- https://git.kernel.org/stable/c/cc7398447810c9450c90d092efe9997569f8d96f