PT-2026-39085 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-21 · CVE-2026-43424

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the USB Target driver's nexus handling. The tpg->tpg nexus pointer is dynamically managed via ConfigFS and can be NULL if a USB host sends requests before the nexus is established or after it is dropped. Functions such as bot submit command() and data transfer paths retrieve tv nexus = tpg->tpg nexus and dereference tv nexus->tvn se sess without validation. A malicious or misconfigured USB host can trigger this by sending a Bulk-Only Transport (BOT) command during this race window, resulting in a kernel panic and local Denial of Service (DoS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-43424

Affected Products

Linux Kernel

References · 19

• https://osv.dev/vulnerability/BELL-CVE-2026-43424 · Vendor Advisory
• https://git.kernel.org/stable/c/b9b26d7f3aa288cfa54a7bc68612bab1f153f156 · Patch
• https://git.kernel.org/stable/c/b9fde507355342a2d64225d582dc8b98ff5ecb19 · Patch
• https://git.kernel.org/stable/c/f962ca3b020e13d6714f27e8c36fe742441c58d1 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43424 · Vendor Advisory
• https://git.kernel.org/stable/c/679d9535aeb15c10bce89c44102004b96624d706 · Patch
• https://git.kernel.org/stable/c/3d309b37633c4a847fc149939a2c9576f1aa1065 · Patch
• https://git.kernel.org/stable/c/2a2ef846a54a06c33b5c2d4b0d918583e1e7c0b7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43424 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-43424 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43424 · Vendor Advisory
• https://git.kernel.org/stable/c/d146f27758049fa55ae4c53785a852d3cf7a18d6 · Patch
• https://ubuntu.com/security/CVE-2026-43424 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43424 · Vendor Advisory
• https://twitter.com/CVEnew/status/2052767649302802609 · Twitter Post