CVE-2026-43324

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43324", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.002Z", "datePublished": "2026-05-08T13:31:08.850Z", "dateUpdated": "2026-08-05T12:27:14.134Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:27:14.134Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: dummy-hcd: Fix interrupt synchronization error\n\nThis fixes an error in synchronization in the dummy-hcd driver. The\nerror has a somewhat involved history. The synchronization mechanism\nwas introduced by commit 7dbd8f4cabd9 (\"USB: dummy-hcd: Fix erroneous\nsynchronization change\"), which added an emulated \"interrupts enabled\"\nflag together with code emulating synchronize_irq() (it waits until\nall current handler callbacks have returned).\n\nBut the emulated interrupt-disable occurred too late, after the driver\ncontaining the handler callback routines had been told that it was\nunbound and no more callbacks would occur. Commit 4a5d797a9f9c (\"usb:\ngadget: dummy_hcd: fix gpf in gadget_setup\") tried to fix this by\nmoving the synchronize_irq() emulation code from dummy_stop() to\ndummy_pullup(), which runs before the unbind callback.\n\nThere still were races, though, because the emulated interrupt-disable\nstill occurred too late. It couldn't be moved to dummy_pullup(),\nbecause that routine can be called for reasons other than an impending\nunbind. Therefore commits 7dc0c55e9f30 (\"USB: UDC core: Add\nudc_async_callbacks gadget op\") and 04145a03db9d (\"USB: UDC: Implement\nudc_async_callbacks in dummy-hcd\") added an API allowing the UDC core\nto tell dummy-hcd exactly when emulated interrupts and their callbacks\nshould be disabled.\n\nThat brings us to the current state of things, which is still wrong\nbecause the emulated synchronize_irq() occurs before the emulated\ninterrupt-disable! That's no good, beause it means that more emulated\ninterrupts can occur after the synchronize_irq() emulation has run,\nleading to the possibility that a callback handler may be running when\nthe gadget driver is unbound.\n\nTo fix this, we have to move the synchronize_irq() emulation code yet\nagain, to the dummy_udc_async_callbacks() routine, which takes care of\nenabling and disabling emulated interrupt requests. The\nsynchronization will now run immediately after emulated interrupts are\ndisabled, which is where it belongs."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable dummy-hcd path is reached through local USB gadget/host emulator interfaces such as raw-gadget, usbfs, configfs, or sysfs unbind paths. It is not network-reachable and dummy-hcd is an in-kernel emulator rather than a physically attached USB device.\nAC:L - Although this is a race, a local attacker can drive both sides by generating emulated USB activity while triggering gadget driver unbind, and the race can be retried. There are no special external conditions beyond attacker-controlled timing.\nPR:L - Exploitation requires local access to the configured dummy-hcd/gadget userspace interfaces, but the relevant raw-gadget and usbfs paths do not themselves impose a kernel capability check once accessible. When uncertain between root-only setup and normal local device access, the higher-severity PR:L is appropriate.\nUI:N - No victim action is needed after the attacker has local access to the relevant device interfaces. The attacker can trigger emulated USB callbacks and unbind locally.\nS:U - The impact remains within the same kernel security authority. This is a standard local kernel memory-safety/availability issue, not a VM escape or cross-authority boundary violation.\nC:H - The synchronization bug can allow asynchronous gadget callbacks to run after or during gadget driver unbind, leaving callback code operating on stale or cleared gadget-driver state. This is a use-after-unbind/use-after-free class condition, so kernel memory disclosure is a defensible worst-case impact.\nI:H - Callback execution against freed or invalid gadget-driver state can be leveraged as kernel memory corruption rather than merely a clean failure. Under the required higher-severity rule, a UAF-style kernel race supports potential arbitrary write or code execution.\nA:H - At minimum, the race can crash the kernel through NULL dereference or stale pointer use in gadget callbacks, as related dummy-hcd synchronization bugs have done. Kernel oops/panic is high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/udc/dummy_hcd.c"], "versions": [{"version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "lessThan": "d847f375b1bcea713143bc02720d13d2d01b012a", "status": "affected", "versionType": "git"}, {"version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "lessThan": "cbf7df5e5d27cd5bea92ee9a75a4b28dbcc718d4", "status": "affected", "versionType": "git"}, {"version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "lessThan": "5aa776c8615bea3b1eaeec87b0788375800ead4f", "status": "affected", "versionType": "git"}, {"version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "lessThan": "94d4fab1dd9e64f45449bcc7d6a5acf796b13015", "status": "affected", "versionType": "git"}, {"version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "lessThan": "5687a09776069bd915560021c9728ca528440128", "status": "affected", "versionType": "git"}, {"version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "lessThan": "8bcd80219d8e10e660bf29b20e41bb8beb4e4cb7", "status": "affected", "versionType": "git"}, {"version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "lessThan": "2ca9e46f8f1f5a297eb0ac83f79d35d5b3a02541", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/udc/dummy_hcd.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.134", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.134"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.12.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.18.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d847f375b1bcea713143bc02720d13d2d01b012a"}, {"url": "https://git.kernel.org/stable/c/cbf7df5e5d27cd5bea92ee9a75a4b28dbcc718d4"}, {"url": "https://git.kernel.org/stable/c/5aa776c8615bea3b1eaeec87b0788375800ead4f"}, {"url": "https://git.kernel.org/stable/c/94d4fab1dd9e64f45449bcc7d6a5acf796b13015"}, {"url": "https://git.kernel.org/stable/c/5687a09776069bd915560021c9728ca528440128"}, {"url": "https://git.kernel.org/stable/c/8bcd80219d8e10e660bf29b20e41bb8beb4e4cb7"}, {"url": "https://git.kernel.org/stable/c/2ca9e46f8f1f5a297eb0ac83f79d35d5b3a02541"}], "title": "USB: dummy-hcd: Fix interrupt synchronization error", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/gadget/udc/dummy_hcd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d847f375b1bcea713143bc02720d13d2d01b012a", "status": "affected", "version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "versionType": "git"}, {"lessThan": "cbf7df5e5d27cd5bea92ee9a75a4b28dbcc718d4", "status": "affected", "version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "versionType": "git"}, {"lessThan": "5aa776c8615bea3b1eaeec87b0788375800ead4f", "status": "affected", "version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "versionType": "git"}, {"lessThan": "94d4fab1dd9e64f45449bcc7d6a5acf796b13015", "status": "affected", "version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "versionType": "git"}, {"lessThan": "5687a09776069bd915560021c9728ca528440128", "status": "affected", "version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "versionType": "git"}, {"lessThan": "8bcd80219d8e10e660bf29b20e41bb8beb4e4cb7", "status": "affected", "version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "versionType": "git"}, {"lessThan": "2ca9e46f8f1f5a297eb0ac83f79d35d5b3a02541", "status": "affected", "version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/gadget/udc/dummy_hcd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.168", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.134", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.81", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.22", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6A985A0-96A3-4E0A-B271-C7200F325EF1", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B", "versionEndExcluding": "6.1.168", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F56F925B-BAF8-4F4B-B62F-1496AF19A307", "versionEndExcluding": "6.6.134", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC", "versionEndExcluding": "6.12.81", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: dummy-hcd: Fix interrupt synchronization error\n\nThis fixes an error in synchronization in the dummy-hcd driver. The\nerror has a somewhat involved history. The synchronization mechanism\nwas introduced by commit 7dbd8f4cabd9 (\"USB: dummy-hcd: Fix erroneous\nsynchronization change\"), which added an emulated \"interrupts enabled\"\nflag together with code emulating synchronize_irq() (it waits until\nall current handler callbacks have returned).\n\nBut the emulated interrupt-disable occurred too late, after the driver\ncontaining the handler callback routines had been told that it was\nunbound and no more callbacks would occur. Commit 4a5d797a9f9c (\"usb:\ngadget: dummy_hcd: fix gpf in gadget_setup\") tried to fix this by\nmoving the synchronize_irq() emulation code from dummy_stop() to\ndummy_pullup(), which runs before the unbind callback.\n\nThere still were races, though, because the emulated interrupt-disable\nstill occurred too late. It couldn't be moved to dummy_pullup(),\nbecause that routine can be called for reasons other than an impending\nunbind. Therefore commits 7dc0c55e9f30 (\"USB: UDC core: Add\nudc_async_callbacks gadget op\") and 04145a03db9d (\"USB: UDC: Implement\nudc_async_callbacks in dummy-hcd\") added an API allowing the UDC core\nto tell dummy-hcd exactly when emulated interrupts and their callbacks\nshould be disabled.\n\nThat brings us to the current state of things, which is still wrong\nbecause the emulated synchronize_irq() occurs before the emulated\ninterrupt-disable! That's no good, beause it means that more emulated\ninterrupts can occur after the synchronize_irq() emulation has run,\nleading to the possibility that a callback handler may be running when\nthe gadget driver is unbound.\n\nTo fix this, we have to move the synchronize_irq() emulation code yet\nagain, to the dummy_udc_async_callbacks() routine, which takes care of\nenabling and disabling emulated interrupt requests. The\nsynchronization will now run immediately after emulated interrupts are\ndisabled, which is where it belongs."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nUSB: dummy-hcd: Correcci\u00f3n de error de sincronizaci\u00f3n de interrupciones\n\nEsto corrige un error de sincronizaci\u00f3n en el controlador dummy-hcd. El error tiene una historia un tanto intrincada. El mecanismo de sincronizaci\u00f3n fue introducido por el commit 7dbd8f4cabd9 (\u2019USB: dummy-hcd: Correcci\u00f3n de cambio de sincronizaci\u00f3n err\u00f3neo\u2019), que a\u00f1adi\u00f3 una bandera emulada de \u2019interrupciones habilitadas\u2019 junto con c\u00f3digo que emula synchronize_irq() (espera hasta que todas las devoluciones de llamada del gestor actuales hayan regresado).\n\nPero la deshabilitaci\u00f3n de interrupciones emulada ocurri\u00f3 demasiado tarde, despu\u00e9s de que al controlador que conten\u00eda las rutinas de devoluci\u00f3n de llamada del gestor se le hab\u00eda informado que estaba desvinculado y que no ocurrir\u00edan m\u00e1s devoluciones de llamada. El commit 4a5d797a9f9c (\u2019usb: gadget: dummy_hcd: correcci\u00f3n de gpf en gadget_setup\u2019) intent\u00f3 corregir esto moviendo el c\u00f3digo de emulaci\u00f3n de synchronize_irq() de dummy_stop() a dummy_pullup(), que se ejecuta antes de la devoluci\u00f3n de llamada de desvinculaci\u00f3n.\n\nSin embargo, a\u00fan hab\u00eda condiciones de carrera, porque la deshabilitaci\u00f3n de interrupciones emulada todav\u00eda ocurr\u00eda demasiado tarde. No pod\u00eda moverse a dummy_pullup(), porque esa rutina puede ser llamada por razones distintas a una desvinculaci\u00f3n inminente. Por lo tanto, los commits 7dc0c55e9f30 (\u2019USB: UDC core: A\u00f1adir operaci\u00f3n de gadget udc_async_callbacks\u2019) y 04145a03db9d (\u2019USB: UDC: Implementar udc_async_callbacks en dummy-hcd\u2019) a\u00f1adieron una API permitiendo al n\u00facleo UDC indicar a dummy-hcd exactamente cu\u00e1ndo las interrupciones emuladas y sus devoluciones de llamada deben ser deshabilitadas.\n\nEso nos lleva al estado actual de las cosas, que sigue siendo incorrecto porque el synchronize_irq() emulado ocurre antes de la deshabilitaci\u00f3n de interrupciones emulada. Eso no es bueno, porque significa que pueden ocurrir m\u00e1s interrupciones emuladas despu\u00e9s de que la emulaci\u00f3n de synchronize_irq() se haya ejecutado, lo que lleva a la posibilidad de que un gestor de devoluci\u00f3n de llamada est\u00e9 ejecut\u00e1ndose cuando el controlador del gadget est\u00e1 desvinculado.\n\nPara corregir esto, tenemos que mover el c\u00f3digo de emulaci\u00f3n de synchronize_irq() una vez m\u00e1s, a la rutina dummy_udc_async_callbacks(), que se encarga de habilitar y deshabilitar las solicitudes de interrupci\u00f3n emuladas. La sincronizaci\u00f3n ahora se ejecutar\u00e1 inmediatamente despu\u00e9s de que las interrupciones emuladas sean deshabilitadas, que es donde debe estar."}], "id": "CVE-2026-43324", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-08T14:16:41.060", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2ca9e46f8f1f5a297eb0ac83f79d35d5b3a02541"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5687a09776069bd915560021c9728ca528440128"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5aa776c8615bea3b1eaeec87b0788375800ead4f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8bcd80219d8e10e660bf29b20e41bb8beb4e4cb7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/94d4fab1dd9e64f45449bcc7d6a5acf796b13015"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cbf7df5e5d27cd5bea92ee9a75a4b28dbcc718d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d847f375b1bcea713143bc02720d13d2d01b012a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: USB: dummy-hcd: Fix interrupt synchronization error", "id": "2468087", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468087"}, "csaw": false, "cwe": "CWE-364", "details": ["A flaw was found in the Linux kernel's dummy-hcd driver. This vulnerability stems from an interrupt synchronization error where emulated interrupts can occur after the system attempts to synchronize interrupt handlers. This timing issue creates a race condition, potentially allowing a callback handler to execute when the associated gadget driver is no longer bound, which could lead to system instability or unexpected behavior."], "name": "CVE-2026-43324", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43324\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43324\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43324.mbox"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04145a03db9d78469e0817ab3a767c76c0fb0947,d847f375b1bcea713143bc02720d13d2d01b012a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04145a03db9d78469e0817ab3a767c76c0fb0947,cbf7df5e5d27cd5bea92ee9a75a4b28dbcc718d4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04145a03db9d78469e0817ab3a767c76c0fb0947,5aa776c8615bea3b1eaeec87b0788375800ead4f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04145a03db9d78469e0817ab3a767c76c0fb0947,94d4fab1dd9e64f45449bcc7d6a5acf796b13015)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04145a03db9d78469e0817ab3a767c76c0fb0947,5687a09776069bd915560021c9728ca528440128)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04145a03db9d78469e0817ab3a767c76c0fb0947,8bcd80219d8e10e660bf29b20e41bb8beb4e4cb7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04145a03db9d78469e0817ab3a767c76c0fb0947,2ca9e46f8f1f5a297eb0ac83f79d35d5b3a02541)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.203,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.168,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.134,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.81,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.22,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.12,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T20:00:12.759135+00:00", "updated": "2026-05-15T20:30:06.378486+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}