PT-2026-37563 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-08 · CVE-2026-43223

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the pvrusb2 media component where the pvr2 send request ex() function fails to handle a scenario where a write USB Request Block (URB)—a data structure used for USB transfers—is submitted successfully, but the subsequent read URB submission fails (for example, due to -ENOMEM). In such cases, the function returns immediately without waiting for the write URB to complete. Because the driver reuses the same URB structure, a following call to pvr2 send request ex() attempts to submit the still-active write URB, which triggers a warning in the usb submit urb() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-43223

Affected Products

Linux Kernel

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2026-43223 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43223 · Vendor Advisory
• https://git.kernel.org/stable/c/a8333c8262aed2aedf608c18edd39cf5342680a7 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43223 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43223 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43223 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43223 · Vendor Advisory
• https://git.kernel.org/stable/c/58dd722b6c3debcddb4684fb256c90fee7f063e5 · Patch
• https://git.kernel.org/stable/c/5f3ac816861c3b8a5d1a3645b17dc3a99d668d94 · Patch
• https://git.kernel.org/stable/c/2011929f0e4cf6a0a34dd6205911b12276904453 · Patch
• https://git.kernel.org/stable/c/cf459d6ffa5e150ef3744b897f936ff24b52bd15 · Patch
• https://git.kernel.org/stable/c/4ba5c7a1aade7090172cbffd4d120bf4cf5ccbde · Patch
• https://ubuntu.com/security/CVE-2026-43223 · Vendor Advisory
• https://git.kernel.org/stable/c/da524c939b1e5ba17f10db4bde4bdaf569ffcda6 · Patch
• https://git.kernel.org/stable/c/77a63f8efc434ddb04667ed632aade58301a2f13 · Patch