CVE-2026-43327

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43327", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.002Z", "datePublished": "2026-05-08T13:31:12.896Z", "dateUpdated": "2026-05-23T16:06:42.428Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:06:42.428Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: dummy-hcd: Fix locking/synchronization error\n\nSyzbot testing was able to provoke an addressing exception and crash\nin the usb_gadget_udc_reset() routine in\ndrivers/usb/gadgets/udc/core.c, resulting from the fact that the\nroutine was called with a second (\"driver\") argument of NULL. The bad\ncaller was set_link_state() in dummy_hcd.c, and the problem arose\nbecause of a race between a USB reset and driver unbind.\n\nThese sorts of races were not supposed to be possible; commit\n7dbd8f4cabd9 (\"USB: dummy-hcd: Fix erroneous synchronization change\"),\nalong with a few followup commits, was written specifically to prevent\nthem. As it turns out, there are (at least) two errors remaining in\nthe code. Another patch will address the second error; this one is\nconcerned with the first.\n\nThe error responsible for the syzbot crash occurred because the\nstop_activity() routine will sometimes drop and then re-acquire the\ndum->lock spinlock. A call to stop_activity() occurs in\nset_link_state() when handling an emulated USB reset, after the test\nof dum->ints_enabled and before the increment of dum->callback_usage.\nThis allowed another thread (doing a driver unbind) to sneak in and\ngrab the spinlock, and then clear dum->ints_enabled and dum->driver.\nNormally this other thread would have to wait for dum->callback_usage\nto go down to 0 before it would clear dum->driver, but in this case it\ndidn't have to wait since dum->callback_usage had not yet been\nincremented.\n\nThe fix is to increment dum->callback_usage _before_ calling\nstop_activity() instead of after. Then the thread doing the unbind\nwill not clear dum->driver until after the call to\nusb_gadget_udc_reset() safely returns and dum->callback_usage has been\ndecremented again."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/udc/dummy_hcd.c"], "versions": [{"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "lessThan": "6350c7dd33ab481ef41c931a238361490c32d15c", "status": "affected", "versionType": "git"}, {"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "lessThan": "cc97fb5969177cccce2e23b31298df220fc7570d", "status": "affected", "versionType": "git"}, {"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "lessThan": "218886b2ef2dea7627d3700ab0abaf4bf9d1161f", "status": "affected", "versionType": "git"}, {"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "lessThan": "791966f85b439b261bf19865cf1c07c065ffb4b4", "status": "affected", "versionType": "git"}, {"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "lessThan": "805b1833d6ed6da5086e610578a28e71bb54fbbb", "status": "affected", "versionType": "git"}, {"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "lessThan": "efbd9441f1e769a7aae1813d497cec09cbdff031", "status": "affected", "versionType": "git"}, {"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "lessThan": "69ab97a693251d6a6093e630060a3c744fd58524", "status": "affected", "versionType": "git"}, {"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "lessThan": "616a63ff495df12863692ab3f9f7b84e3fa7a66d", "status": "affected", "versionType": "git"}, {"version": "7b416b9dac6ede26d4ca0c1a88b448b543623ff3", "status": "affected", "versionType": "git"}, {"version": "8590bc1da625dd4a589eac0fc3aa3cf4f400424d", "status": "affected", "versionType": "git"}, {"version": "a867d5b932ac4911d3f8a1e63505061b0c81f889", "status": "affected", "versionType": "git"}, {"version": "e84b4a008365b7edbd842a063ae28d040a98db25", "status": "affected", "versionType": "git"}, {"version": "e39b17143a5b5aac81f066d455e5d3a9877eb3ae", "status": "affected", "versionType": "git"}, {"version": "4f8ae1fcb0dfbb72a7678f81bf01fb7fc85c6715", "status": "affected", "versionType": "git"}, {"version": "3.2.97", "lessThan": "3.3", "status": "affected", "versionType": "semver"}, {"version": "3.16.52", "lessThan": "3.17", "status": "affected", "versionType": "semver"}, {"version": "4.1.46", "lessThan": "4.2", "status": "affected", "versionType": "semver"}, {"version": "4.4.92", "lessThan": "4.5", "status": "affected", "versionType": "semver"}, {"version": "4.9.55", "lessThan": "4.10", "status": "affected", "versionType": "semver"}, {"version": "4.13.6", "lessThan": "4.14", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/udc/dummy_hcd.c"], "versions": [{"version": "4.14", "status": "affected"}, {"version": "0", "lessThan": "4.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.134", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.1.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.6.134"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.12.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.18.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.92"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6350c7dd33ab481ef41c931a238361490c32d15c"}, {"url": "https://git.kernel.org/stable/c/cc97fb5969177cccce2e23b31298df220fc7570d"}, {"url": "https://git.kernel.org/stable/c/218886b2ef2dea7627d3700ab0abaf4bf9d1161f"}, {"url": "https://git.kernel.org/stable/c/791966f85b439b261bf19865cf1c07c065ffb4b4"}, {"url": "https://git.kernel.org/stable/c/805b1833d6ed6da5086e610578a28e71bb54fbbb"}, {"url": "https://git.kernel.org/stable/c/efbd9441f1e769a7aae1813d497cec09cbdff031"}, {"url": "https://git.kernel.org/stable/c/69ab97a693251d6a6093e630060a3c744fd58524"}, {"url": "https://git.kernel.org/stable/c/616a63ff495df12863692ab3f9f7b84e3fa7a66d"}], "title": "USB: dummy-hcd: Fix locking/synchronization error", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/gadget/udc/dummy_hcd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6350c7dd33ab481ef41c931a238361490c32d15c", "status": "affected", "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "versionType": "git"}, {"lessThan": "cc97fb5969177cccce2e23b31298df220fc7570d", "status": "affected", "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "versionType": "git"}, {"lessThan": "218886b2ef2dea7627d3700ab0abaf4bf9d1161f", "status": "affected", "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "versionType": "git"}, {"lessThan": "791966f85b439b261bf19865cf1c07c065ffb4b4", "status": "affected", "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "versionType": "git"}, {"lessThan": "805b1833d6ed6da5086e610578a28e71bb54fbbb", "status": "affected", "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "versionType": "git"}, {"lessThan": "efbd9441f1e769a7aae1813d497cec09cbdff031", "status": "affected", "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "versionType": "git"}, {"lessThan": "69ab97a693251d6a6093e630060a3c744fd58524", "status": "affected", "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "versionType": "git"}, {"lessThan": "616a63ff495df12863692ab3f9f7b84e3fa7a66d", "status": "affected", "version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81", "versionType": "git"}, {"status": "affected", "version": "7b416b9dac6ede26d4ca0c1a88b448b543623ff3", "versionType": "git"}, {"status": "affected", "version": "8590bc1da625dd4a589eac0fc3aa3cf4f400424d", "versionType": "git"}, {"status": "affected", "version": "a867d5b932ac4911d3f8a1e63505061b0c81f889", "versionType": "git"}, {"status": "affected", "version": "e84b4a008365b7edbd842a063ae28d040a98db25", "versionType": "git"}, {"status": "affected", "version": "e39b17143a5b5aac81f066d455e5d3a9877eb3ae", "versionType": "git"}, {"status": "affected", "version": "4f8ae1fcb0dfbb72a7678f81bf01fb7fc85c6715", "versionType": "git"}, {"lessThan": "3.3", "status": "affected", "version": "3.2.97", "versionType": "semver"}, {"lessThan": "3.17", "status": "affected", "version": "3.16.52", "versionType": "semver"}, {"lessThan": "4.2", "status": "affected", "version": "4.1.46", "versionType": "semver"}, {"lessThan": "4.5", "status": "affected", "version": "4.4.92", "versionType": "semver"}, {"lessThan": "4.10", "status": "affected", "version": "4.9.55", "versionType": "semver"}, {"lessThan": "4.14", "status": "affected", "version": "4.13.6", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/gadget/udc/dummy_hcd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.14"}, {"lessThan": "4.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.168", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.134", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.81", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.22", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "53EFF502-4DAC-47BB-88FE-57DAEB8A756F", "versionEndExcluding": "3.3", "versionStartIncluding": "3.2.97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "05033BFD-A5E6-4D50-861A-0DFC71F68928", "versionEndExcluding": "3.17", "versionStartIncluding": "3.16.52", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD7B43DB-D99B-4203-84D2-00416A5FC499", "versionEndExcluding": "4.2", "versionStartIncluding": "4.1.46", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FC36FA2-9326-4373-A290-AD56F4EBE515", "versionEndExcluding": "4.5", "versionStartIncluding": "4.4.92", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FF00429D-1E4D-4240-A156-ECC8962E597D", "versionEndExcluding": "4.10", "versionStartIncluding": "4.9.55", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7144BCBC-124B-49FA-8BCC-259910F77E5A", "versionEndExcluding": "5.10.253", "versionStartIncluding": "4.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B", "versionEndExcluding": "6.1.168", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F56F925B-BAF8-4F4B-B62F-1496AF19A307", "versionEndExcluding": "6.6.134", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC", "versionEndExcluding": "6.12.81", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: dummy-hcd: Fix locking/synchronization error\n\nSyzbot testing was able to provoke an addressing exception and crash\nin the usb_gadget_udc_reset() routine in\ndrivers/usb/gadgets/udc/core.c, resulting from the fact that the\nroutine was called with a second (\"driver\") argument of NULL. The bad\ncaller was set_link_state() in dummy_hcd.c, and the problem arose\nbecause of a race between a USB reset and driver unbind.\n\nThese sorts of races were not supposed to be possible; commit\n7dbd8f4cabd9 (\"USB: dummy-hcd: Fix erroneous synchronization change\"),\nalong with a few followup commits, was written specifically to prevent\nthem. As it turns out, there are (at least) two errors remaining in\nthe code. Another patch will address the second error; this one is\nconcerned with the first.\n\nThe error responsible for the syzbot crash occurred because the\nstop_activity() routine will sometimes drop and then re-acquire the\ndum->lock spinlock. A call to stop_activity() occurs in\nset_link_state() when handling an emulated USB reset, after the test\nof dum->ints_enabled and before the increment of dum->callback_usage.\nThis allowed another thread (doing a driver unbind) to sneak in and\ngrab the spinlock, and then clear dum->ints_enabled and dum->driver.\nNormally this other thread would have to wait for dum->callback_usage\nto go down to 0 before it would clear dum->driver, but in this case it\ndidn't have to wait since dum->callback_usage had not yet been\nincremented.\n\nThe fix is to increment dum->callback_usage _before_ calling\nstop_activity() instead of after. Then the thread doing the unbind\nwill not clear dum->driver until after the call to\nusb_gadget_udc_reset() safely returns and dum->callback_usage has been\ndecremented again."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nUSB: dummy-hcd: Correcci\u00f3n de error de bloqueo/sincronizaci\u00f3n\n\nLas pruebas de Syzbot pudieron provocar una excepci\u00f3n de direccionamiento y un fallo en la rutina usb_gadget_udc_reset() en drivers/usb/gadgets/udc/core.c, lo que result\u00f3 del hecho de que la rutina fue llamada con un segundo argumento (\u2019driver\u2019) de NULL. El llamador err\u00f3neo fue set_link_state() en dummy_hcd.c, y el problema surgi\u00f3 debido a una condici\u00f3n de carrera entre un reinicio USB y la desvinculaci\u00f3n del controlador.\n\nEste tipo de condiciones de carrera no se supon\u00eda que fueran posibles; el commit 7dbd8f4cabd9 (\u2019USB: dummy-hcd: Fix erroneous synchronization change\u2019), junto con algunos commits de seguimiento, fue escrito espec\u00edficamente para prevenirlas. Resulta que quedan (al menos) dos errores en el c\u00f3digo. Otro parche abordar\u00e1 el segundo error; este se ocupa del primero.\n\nEl error responsable del fallo de syzbot ocurri\u00f3 porque la rutina stop_activity() a veces liberar\u00e1 y luego volver\u00e1 a adquirir el spinlock dum -> lock. Una llamada a stop_activity() ocurre en set_link_state() al manejar un reinicio USB emulado, despu\u00e9s de la prueba de dum -> ints_enabled y antes del incremento de dum -> callback_usage. Esto permiti\u00f3 que otro hilo (realizando una desvinculaci\u00f3n del controlador) se colara y tomara el spinlock, y luego borrara dum -> ints_enabled y dum -> driver. Normalmente, este otro hilo tendr\u00eda que esperar a que dum -> callback_usage bajara a 0 antes de que borrara dum -> driver, pero en este caso no tuvo que esperar ya que dum -> callback_usage a\u00fan no hab\u00eda sido incrementado.\n\nLa soluci\u00f3n es incrementar dum -> callback_usage _antes_ de llamar a stop_activity() en lugar de despu\u00e9s. Entonces el hilo que realiza la desvinculaci\u00f3n no borrar\u00e1 dum -> driver hasta despu\u00e9s de que la llamada a usb_gadget_udc_reset() regrese de forma segura y dum -> callback_usage haya sido decrementado de nuevo."}], "id": "CVE-2026-43327", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-08T14:16:42.243", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/218886b2ef2dea7627d3700ab0abaf4bf9d1161f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/616a63ff495df12863692ab3f9f7b84e3fa7a66d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6350c7dd33ab481ef41c931a238361490c32d15c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/69ab97a693251d6a6093e630060a3c744fd58524"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/791966f85b439b261bf19865cf1c07c065ffb4b4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/805b1833d6ed6da5086e610578a28e71bb54fbbb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc97fb5969177cccce2e23b31298df220fc7570d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/efbd9441f1e769a7aae1813d497cec09cbdff031"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: USB: dummy-hcd: Fix locking/synchronization error", "id": "2468099", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468099"}, "csaw": false, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's USB dummy-hcd driver. A race condition between a USB reset operation and a driver unbind operation can lead to a synchronization error. This allows a local attacker with physical access to a USB device to trigger an addressing exception, causing a system crash and resulting in a Denial of Service."], "name": "CVE-2026-43327", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43327\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43327\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43327.mbox"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7dbd8f4cabd96db5a50513de9d83a8105a5ffc81,6350c7dd33ab481ef41c931a238361490c32d15c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7dbd8f4cabd96db5a50513de9d83a8105a5ffc81,cc97fb5969177cccce2e23b31298df220fc7570d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7dbd8f4cabd96db5a50513de9d83a8105a5ffc81,218886b2ef2dea7627d3700ab0abaf4bf9d1161f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7dbd8f4cabd96db5a50513de9d83a8105a5ffc81,791966f85b439b261bf19865cf1c07c065ffb4b4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7dbd8f4cabd96db5a50513de9d83a8105a5ffc81,805b1833d6ed6da5086e610578a28e71bb54fbbb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7dbd8f4cabd96db5a50513de9d83a8105a5ffc81,efbd9441f1e769a7aae1813d497cec09cbdff031)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7dbd8f4cabd96db5a50513de9d83a8105a5ffc81,69ab97a693251d6a6093e630060a3c744fd58524)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7dbd8f4cabd96db5a50513de9d83a8105a5ffc81,616a63ff495df12863692ab3f9f7b84e3fa7a66d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "7b416b9dac6ede26d4ca0c1a88b448b543623ff3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "8590bc1da625dd4a589eac0fc3aa3cf4f400424d"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "a867d5b932ac4911d3f8a1e63505061b0c81f889"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e84b4a008365b7edbd842a063ae28d040a98db25"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e39b17143a5b5aac81f066d455e5d3a9877eb3ae"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "4f8ae1fcb0dfbb72a7678f81bf01fb7fc85c6715"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.253,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.203,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.168,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.134,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.81,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.22,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.12,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T19:30:05.521693+00:00", "updated": "2026-05-19T01:30:26.329906+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}