PT-2026-38978 · Linux · Linux Kernel

Syzbot · Published 2026-05-08 · Updated 2026-05-21 · CVE-2026-43327

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A locking and synchronization error exists in the USB dummy-hcd component. A race condition can occur between a USB reset and a driver unbind process. Specifically, the stop activity() function may drop and re-acquire the dum->lock spinlock. If this occurs within set link state() after checking dum->ints enabled but before incrementing dum->callback usage, another thread performing a driver unbind can clear dum->ints enabled and dum->driver. This leads to the usb gadget udc reset() function being called with a NULL driver argument, resulting in an addressing exception and system crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2026-43327

Affected Products

Linux Kernel

References · 20

• https://git.kernel.org/stable/c/6350c7dd33ab481ef41c931a238361490c32d15c · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-43327 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43327 · Security Note
• https://ubuntu.com/security/CVE-2026-43327 · Vendor Advisory
• https://git.kernel.org/stable/c/218886b2ef2dea7627d3700ab0abaf4bf9d1161f · Patch
• https://git.kernel.org/stable/c/efbd9441f1e769a7aae1813d497cec09cbdff031 · Patch
• https://git.kernel.org/stable/c/cc97fb5969177cccce2e23b31298df220fc7570d · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43327 · Vendor Advisory
• https://git.kernel.org/stable/c/805b1833d6ed6da5086e610578a28e71bb54fbbb · Patch
• https://git.kernel.org/stable/c/69ab97a693251d6a6093e630060a3c744fd58524 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43327 · Vendor Advisory
• https://git.kernel.org/stable/c/791966f85b439b261bf19865cf1c07c065ffb4b4 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-43327 · Vendor Advisory
• https://git.kernel.org/stable/c/616a63ff495df12863692ab3f9f7b84e3fa7a66d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43327 · Security Note