CVE-2026-43424

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43424", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.008Z", "datePublished": "2026-05-08T14:21:58.365Z", "dateUpdated": "2026-05-11T22:24:19.268Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:24:19.268Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling\n\nThe `tpg->tpg_nexus` pointer in the USB Target driver is dynamically\nmanaged and tied to userspace configuration via ConfigFS. It can be\nNULL if the USB host sends requests before the nexus is fully\nestablished or immediately after it is dropped.\n\nCurrently, functions like `bot_submit_command()` and the data\ntransfer paths retrieve `tv_nexus = tpg->tpg_nexus` and immediately\ndereference `tv_nexus->tvn_se_sess` without any validation. If a\nmalicious or misconfigured USB host sends a BOT (Bulk-Only Transport)\ncommand during this race window, it triggers a NULL pointer\ndereference, leading to a kernel panic (local DoS).\n\nThis exposes an inconsistent API usage within the module, as peer\nfunctions like `usbg_submit_command()` and `bot_send_bad_response()`\ncorrectly implement a NULL check for `tv_nexus` before proceeding.\n\nFix this by bringing consistency to the nexus handling. Add the\nmissing `if (!tv_nexus)` checks to the vulnerable BOT command and\nrequest processing paths, aborting the command gracefully with an\nerror instead of crashing the system."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/f_tcm.c"], "versions": [{"version": "c52661d60f636d17e26ad834457db333bd1df494", "lessThan": "b9b26d7f3aa288cfa54a7bc68612bab1f153f156", "status": "affected", "versionType": "git"}, {"version": "c52661d60f636d17e26ad834457db333bd1df494", "lessThan": "2a2ef846a54a06c33b5c2d4b0d918583e1e7c0b7", "status": "affected", "versionType": "git"}, {"version": "c52661d60f636d17e26ad834457db333bd1df494", "lessThan": "d146f27758049fa55ae4c53785a852d3cf7a18d6", "status": "affected", "versionType": "git"}, {"version": "c52661d60f636d17e26ad834457db333bd1df494", "lessThan": "f962ca3b020e13d6714f27e8c36fe742441c58d1", "status": "affected", "versionType": "git"}, {"version": "c52661d60f636d17e26ad834457db333bd1df494", "lessThan": "679d9535aeb15c10bce89c44102004b96624d706", "status": "affected", "versionType": "git"}, {"version": "c52661d60f636d17e26ad834457db333bd1df494", "lessThan": "3d309b37633c4a847fc149939a2c9576f1aa1065", "status": "affected", "versionType": "git"}, {"version": "c52661d60f636d17e26ad834457db333bd1df494", "lessThan": "b9fde507355342a2d64225d582dc8b98ff5ecb19", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/f_tcm.c"], "versions": [{"version": "3.5", "status": "affected"}, {"version": "0", "lessThan": "3.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.19", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.9", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.1.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.12.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.18.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.19.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b9b26d7f3aa288cfa54a7bc68612bab1f153f156"}, {"url": "https://git.kernel.org/stable/c/2a2ef846a54a06c33b5c2d4b0d918583e1e7c0b7"}, {"url": "https://git.kernel.org/stable/c/d146f27758049fa55ae4c53785a852d3cf7a18d6"}, {"url": "https://git.kernel.org/stable/c/f962ca3b020e13d6714f27e8c36fe742441c58d1"}, {"url": "https://git.kernel.org/stable/c/679d9535aeb15c10bce89c44102004b96624d706"}, {"url": "https://git.kernel.org/stable/c/3d309b37633c4a847fc149939a2c9576f1aa1065"}, {"url": "https://git.kernel.org/stable/c/b9fde507355342a2d64225d582dc8b98ff5ecb19"}], "title": "usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/gadget/function/f_tcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b9b26d7f3aa288cfa54a7bc68612bab1f153f156", "status": "affected", "version": "c52661d60f636d17e26ad834457db333bd1df494", "versionType": "git"}, {"lessThan": "2a2ef846a54a06c33b5c2d4b0d918583e1e7c0b7", "status": "affected", "version": "c52661d60f636d17e26ad834457db333bd1df494", "versionType": "git"}, {"lessThan": "d146f27758049fa55ae4c53785a852d3cf7a18d6", "status": "affected", "version": "c52661d60f636d17e26ad834457db333bd1df494", "versionType": "git"}, {"lessThan": "f962ca3b020e13d6714f27e8c36fe742441c58d1", "status": "affected", "version": "c52661d60f636d17e26ad834457db333bd1df494", "versionType": "git"}, {"lessThan": "679d9535aeb15c10bce89c44102004b96624d706", "status": "affected", "version": "c52661d60f636d17e26ad834457db333bd1df494", "versionType": "git"}, {"lessThan": "3d309b37633c4a847fc149939a2c9576f1aa1065", "status": "affected", "version": "c52661d60f636d17e26ad834457db333bd1df494", "versionType": "git"}, {"lessThan": "b9fde507355342a2d64225d582dc8b98ff5ecb19", "status": "affected", "version": "c52661d60f636d17e26ad834457db333bd1df494", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/gadget/function/f_tcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.5"}, {"lessThan": "3.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.167", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.130", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.78", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.19", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "69A57346-D8E9-487F-A201-B8C0896B3D73", "versionEndExcluding": "5.10.253", "versionStartIncluding": "3.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "56D62904-7C85-4BED-9EC0-3982B880F72D", "versionEndExcluding": "6.1.167", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "28D591F5-B196-4CC9-905C-DC80F116E7A8", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D394AC60-6F28-435F-872A-CCDF384B8331", "versionEndExcluding": "6.18.19", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling\n\nThe `tpg->tpg_nexus` pointer in the USB Target driver is dynamically\nmanaged and tied to userspace configuration via ConfigFS. It can be\nNULL if the USB host sends requests before the nexus is fully\nestablished or immediately after it is dropped.\n\nCurrently, functions like `bot_submit_command()` and the data\ntransfer paths retrieve `tv_nexus = tpg->tpg_nexus` and immediately\ndereference `tv_nexus->tvn_se_sess` without any validation. If a\nmalicious or misconfigured USB host sends a BOT (Bulk-Only Transport)\ncommand during this race window, it triggers a NULL pointer\ndereference, leading to a kernel panic (local DoS).\n\nThis exposes an inconsistent API usage within the module, as peer\nfunctions like `usbg_submit_command()` and `bot_send_bad_response()`\ncorrectly implement a NULL check for `tv_nexus` before proceeding.\n\nFix this by bringing consistency to the nexus handling. Add the\nmissing `if (!tv_nexus)` checks to the vulnerable BOT command and\nrequest processing paths, aborting the command gracefully with an\nerror instead of crashing the system."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: f_tcm: Correcci\u00f3n de desreferencias de puntero NULL en el manejo de nexos\n\nEl puntero \u201ctpg -> tpg_nexus\u201d en el controlador USB Target se gestiona din\u00e1micamente y est\u00e1 vinculado a la configuraci\u00f3n del espacio de usuario a trav\u00e9s de ConfigFS. Puede ser NULL si el host USB env\u00eda solicitudes antes de que el nexo est\u00e9 completamente establecido o inmediatamente despu\u00e9s de que se elimine.\n\nActualmente, funciones como \u201cbot_submit_command()\u201d y las rutas de transferencia de datos recuperan \u201ctv_nexus = tpg -> tpg_nexus\u201d y desreferencian inmediatamente \u201ctv_nexus -> tvn_se_sess\u201d sin ninguna validaci\u00f3n. Si un host USB malicioso o mal configurado env\u00eda un comando BOT (Bulk-Only Transport) durante esta ventana de carrera, desencadena una desreferencia de puntero NULL, lo que lleva a un p\u00e1nico del kernel (DoS local).\n\nEsto expone un uso inconsistente de la API dentro del m\u00f3dulo, ya que funciones pares como \u201cusbg_submit_command()\u201d y \u201cbot_send_bad_response()\u201d implementan correctamente una verificaci\u00f3n de NULL para \u201ctv_nexus\u201d antes de continuar.\n\nSolucione esto aportando consistencia al manejo del nexo. Agregue las verificaciones \u201cif (!tv_nexus)\u201d faltantes a las rutas vulnerables de procesamiento de comandos BOT y solicitudes, abortando el comando de forma elegante con un error en lugar de bloquear el sistema."}], "id": "CVE-2026-43424", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-08T15:16:54.497", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2a2ef846a54a06c33b5c2d4b0d918583e1e7c0b7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3d309b37633c4a847fc149939a2c9576f1aa1065"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/679d9535aeb15c10bce89c44102004b96624d706"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b9b26d7f3aa288cfa54a7bc68612bab1f153f156"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b9fde507355342a2d64225d582dc8b98ff5ecb19"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d146f27758049fa55ae4c53785a852d3cf7a18d6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f962ca3b020e13d6714f27e8c36fe742441c58d1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling", "id": "2468216", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468216"}, "csaw": false, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's USB gadget subsystem (f_tcm). A malicious or misconfigured USB host can exploit a race condition by sending specific Bulk-Only Transport (BOT) commands. This can trigger a NULL pointer dereference, leading to a kernel panic and a local Denial of Service (DoS) on the affected system."], "name": "CVE-2026-43424", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43424\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43424\nhttps://lore.kernel.org/linux-cve-announce/2026050848-CVE-2026-43424-0d0d@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c52661d60f636d17e26ad834457db333bd1df494,b9b26d7f3aa288cfa54a7bc68612bab1f153f156)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c52661d60f636d17e26ad834457db333bd1df494,2a2ef846a54a06c33b5c2d4b0d918583e1e7c156)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c52661d60f636d17e26ad834457db333bd1df494,d146f27758049fa55ae4c53785a852d3cf7a18d6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c52661d60f636d17e26ad834457db333bd1df494,f962ca3b020e13d6714f27e8c36fe742441c58d1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c52661d60f636d17e26ad834457db333bd1df494,679d9535aeb15c10bce89c44102004b96624d706)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c52661d60f636d17e26ad834457db333bd1df494,3d309b37633c4a847fc149939a2c9576f1aa1065)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c52661d60f636d17e26ad834457db333bd1df494,b9fde507355342a2d64225d582dc8b98ff5ecb19)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.5)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.253,5.11.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.167,6.2.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.130,6.7.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.78,6.13.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.19,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.9,6.20.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T20:45:16.336252+00:00", "updated": "2026-05-20T21:00:12.344567+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}