PT-2026-37590 · Linux · Linux Kernel

Published 2026-05-06 · Updated 2026-05-09 · CVE-2026-43250

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The ChipIdea UDC driver fails to properly unmap DMA buffers or clean up scatter-gather bounce buffers when the ep nuke() function is called during a USB device disconnection during an active transfer. This occurs because the num mapped sgs field and sgt.sgl pointer retain stale values. If the gadget driver reuses the request upon reconnection without reinitialization, the hardware enqueue() function may skip DMA mapping and use invalid DMA addresses, potentially leading to memory corruption and alignment errors.

Recommendations Update the Linux kernel to a version where the ep nuke() function includes calls to usb gadget unmap request by dev() when num mapped sgs is set and sglist do debounce() when a bounce buffer exists.

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-43250

Affected Products

Linux Kernel

References · 14

• https://cve.org/CVERecord?id=CVE-2026-43250 · Security Note
• https://git.kernel.org/stable/c/1b72b834511d17f4d069d512f78671f3f210a2f1 · Patch
• https://git.kernel.org/stable/c/e74c436f8568af1c60942469d0a2300b3ada3857 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43250 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43250 · Security Note
• https://git.kernel.org/stable/c/cea2a1257a3b5ea3e769a445b34af13e6aa5a123 · Patch
• https://git.kernel.org/stable/c/f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43250 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43250 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43250 · Vendor Advisory
• https://git.kernel.org/linus/cea2a1257a3b5ea3e769a445b34af13e6aa5a123 · Note
• https://twitter.com/windowsforum/status/2052319537064784225 · Twitter Post
• https://docs.bell-sw.com/security/cves/CVE-2026-43250 · Note