CVE-2026-43432

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43432", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.009Z", "datePublished": "2026-05-08T14:22:03.985Z", "dateUpdated": "2026-11-06T15:42:53.707Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:06:59.368Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix memory leak in xhci_disable_slot()\n\nxhci_alloc_command() allocates a command structure and, when the\nsecond argument is true, also allocates a completion structure.\nCurrently, the error handling path in xhci_disable_slot() only frees\nthe command structure using kfree(), causing the completion structure\nto leak.\n\nUse xhci_free_command() instead of kfree(). xhci_free_command() correctly\nfrees both the command structure and the associated completion structure.\nSince the command structure is allocated with zero-initialization,\ncommand->in_ctx is NULL and will not be erroneously freed by\nxhci_free_command().\n\nThis bug was found using an experimental static analysis tool we are\ndeveloping. The tool is based on the LLVM framework and is specifically\ndesigned to detect memory management issues. It is currently under\nactive development and not yet publicly available, but we plan to\nopen-source it after our research is published.\n\nThe bug was originally detected on v6.13-rc1 using our static analysis\ntool, and we have verified that the issue persists in the latest mainline\nkernel.\n\nWe performed build testing on x86_64 with allyesconfig using GCC=11.4.0.\nSince triggering these error paths in xhci_disable_slot() requires specific\nhardware conditions or abnormal state, we were unable to construct a test\ncase to reliably trigger these specific error paths at runtime."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/host/xhci.c"], "versions": [{"version": "fee8be5bde562d4f5f9a100ca80c6d7072ed34c8", "lessThan": "1e800e26d54ccf2ddf2ea6d6cbe021c804d8aa62", "status": "affected", "versionType": "git"}, {"version": "02d5a2a48bb44e7404b794df87e57588b2fd604e", "lessThan": "6288baf0c8c4dcfbf206773aede9c1f2269cec28", "status": "affected", "versionType": "git"}, {"version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "lessThan": "46aea90763832cd6e9b0c2e1c00e6a9512156d4b", "status": "affected", "versionType": "git"}, {"version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "lessThan": "2e2baa8fb5aa4d080cbfeb84c51eff797529f413", "status": "affected", "versionType": "git"}, {"version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "lessThan": "807e4fb5140c73eb5dba1e399a990db5c1f3cdf8", "status": "affected", "versionType": "git"}, {"version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "lessThan": "c65f1b840ab8ce72ba68f1b63bab7960f8fdfa89", "status": "affected", "versionType": "git"}, {"version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "lessThan": "078b446efc0f5e496c31bccb72b98af979963a83", "status": "affected", "versionType": "git"}, {"version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "lessThan": "c1c8550e70401159184130a1afc6261db01fc0ce", "status": "affected", "versionType": "git"}, {"version": "cc7c2818c71ebace207df40cc586c8c74e3d1a59", "status": "affected", "versionType": "git"}, {"version": "ec0cddcc2454ab08193beb473978f8f8889b7e24", "status": "affected", "versionType": "git"}, {"version": "5.10.85", "lessThan": "5.10.253", "status": "affected", "versionType": "semver"}, {"version": "5.15.8", "lessThan": "5.15.203", "status": "affected", "versionType": "semver"}, {"version": "4.19.221", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.165", "lessThan": "5.5", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/host/xhci.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.19", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.9", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.85", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.8", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.19.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.165"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1e800e26d54ccf2ddf2ea6d6cbe021c804d8aa62"}, {"url": "https://git.kernel.org/stable/c/6288baf0c8c4dcfbf206773aede9c1f2269cec28"}, {"url": "https://git.kernel.org/stable/c/46aea90763832cd6e9b0c2e1c00e6a9512156d4b"}, {"url": "https://git.kernel.org/stable/c/2e2baa8fb5aa4d080cbfeb84c51eff797529f413"}, {"url": "https://git.kernel.org/stable/c/807e4fb5140c73eb5dba1e399a990db5c1f3cdf8"}, {"url": "https://git.kernel.org/stable/c/c65f1b840ab8ce72ba68f1b63bab7960f8fdfa89"}, {"url": "https://git.kernel.org/stable/c/078b446efc0f5e496c31bccb72b98af979963a83"}, {"url": "https://git.kernel.org/stable/c/c1c8550e70401159184130a1afc6261db01fc0ce"}], "title": "usb: xhci: Fix memory leak in xhci_disable_slot()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43432", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:38:24.180135Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:42:53.707Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43432", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:38:24.180135Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:38:25.678Z"}}], "cna": {"title": "usb: xhci: Fix memory leak in xhci_disable_slot()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "fee8be5bde562d4f5f9a100ca80c6d7072ed34c8", "lessThan": "1e800e26d54ccf2ddf2ea6d6cbe021c804d8aa62", "versionType": "git"}, {"status": "affected", "version": "02d5a2a48bb44e7404b794df87e57588b2fd604e", "lessThan": "6288baf0c8c4dcfbf206773aede9c1f2269cec28", "versionType": "git"}, {"status": "affected", "version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "lessThan": "46aea90763832cd6e9b0c2e1c00e6a9512156d4b", "versionType": "git"}, {"status": "affected", "version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "lessThan": "2e2baa8fb5aa4d080cbfeb84c51eff797529f413", "versionType": "git"}, {"status": "affected", "version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "lessThan": "807e4fb5140c73eb5dba1e399a990db5c1f3cdf8", "versionType": "git"}, {"status": "affected", "version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "lessThan": "c65f1b840ab8ce72ba68f1b63bab7960f8fdfa89", "versionType": "git"}, {"status": "affected", "version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "lessThan": "078b446efc0f5e496c31bccb72b98af979963a83", "versionType": "git"}, {"status": "affected", "version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "lessThan": "c1c8550e70401159184130a1afc6261db01fc0ce", "versionType": "git"}, {"status": "affected", "version": "cc7c2818c71ebace207df40cc586c8c74e3d1a59", "versionType": "git"}, {"status": "affected", "version": "ec0cddcc2454ab08193beb473978f8f8889b7e24", "versionType": "git"}, {"status": "affected", "version": "5.10.85", "lessThan": "5.10.253", "versionType": "semver"}, {"status": "affected", "version": "5.15.8", "lessThan": "5.15.203", "versionType": "semver"}, {"status": "affected", "version": "4.19.221", "lessThan": "4.20", "versionType": "semver"}, {"status": "affected", "version": "5.4.165", "lessThan": "5.5", "versionType": "semver"}], "programFiles": ["drivers/usb/host/xhci.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"status": "unaffected", "version": "0", "lessThan": "5.16", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.253", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.167", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.130", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.78", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.19", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.9", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/usb/host/xhci.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1e800e26d54ccf2ddf2ea6d6cbe021c804d8aa62"}, {"url": "https://git.kernel.org/stable/c/6288baf0c8c4dcfbf206773aede9c1f2269cec28"}, {"url": "https://git.kernel.org/stable/c/46aea90763832cd6e9b0c2e1c00e6a9512156d4b"}, {"url": "https://git.kernel.org/stable/c/2e2baa8fb5aa4d080cbfeb84c51eff797529f413"}, {"url": "https://git.kernel.org/stable/c/807e4fb5140c73eb5dba1e399a990db5c1f3cdf8"}, {"url": "https://git.kernel.org/stable/c/c65f1b840ab8ce72ba68f1b63bab7960f8fdfa89"}, {"url": "https://git.kernel.org/stable/c/078b446efc0f5e496c31bccb72b98af979963a83"}, {"url": "https://git.kernel.org/stable/c/c1c8550e70401159184130a1afc6261db01fc0ce"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix memory leak in xhci_disable_slot()\n\nxhci_alloc_command() allocates a command structure and, when the\nsecond argument is true, also allocates a completion structure.\nCurrently, the error handling path in xhci_disable_slot() only frees\nthe command structure using kfree(), causing the completion structure\nto leak.\n\nUse xhci_free_command() instead of kfree(). xhci_free_command() correctly\nfrees both the command structure and the associated completion structure.\nSince the command structure is allocated with zero-initialization,\ncommand->in_ctx is NULL and will not be erroneously freed by\nxhci_free_command().\n\nThis bug was found using an experimental static analysis tool we are\ndeveloping. The tool is based on the LLVM framework and is specifically\ndesigned to detect memory management issues. It is currently under\nactive development and not yet publicly available, but we plan to\nopen-source it after our research is published.\n\nThe bug was originally detected on v6.13-rc1 using our static analysis\ntool, and we have verified that the issue persists in the latest mainline\nkernel.\n\nWe performed build testing on x86_64 with allyesconfig using GCC=11.4.0.\nSince triggering these error paths in xhci_disable_slot() requires specific\nhardware conditions or abnormal state, we were unable to construct a test\ncase to reliably trigger these specific error paths at runtime."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.253", "versionStartIncluding": "5.10.85"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.15.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.167", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.130", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.78", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.19", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.9", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.19.221"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.4.165"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:06:59.368Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43432", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:42:53.707Z", "dateReserved": "2026-05-01T14:12:56.009Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-08T14:22:03.985Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/host/xhci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1e800e26d54ccf2ddf2ea6d6cbe021c804d8aa62", "status": "affected", "version": "fee8be5bde562d4f5f9a100ca80c6d7072ed34c8", "versionType": "git"}, {"lessThan": "6288baf0c8c4dcfbf206773aede9c1f2269cec28", "status": "affected", "version": "02d5a2a48bb44e7404b794df87e57588b2fd604e", "versionType": "git"}, {"lessThan": "46aea90763832cd6e9b0c2e1c00e6a9512156d4b", "status": "affected", "version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "versionType": "git"}, {"lessThan": "2e2baa8fb5aa4d080cbfeb84c51eff797529f413", "status": "affected", "version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "versionType": "git"}, {"lessThan": "807e4fb5140c73eb5dba1e399a990db5c1f3cdf8", "status": "affected", "version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "versionType": "git"}, {"lessThan": "c65f1b840ab8ce72ba68f1b63bab7960f8fdfa89", "status": "affected", "version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "versionType": "git"}, {"lessThan": "078b446efc0f5e496c31bccb72b98af979963a83", "status": "affected", "version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "versionType": "git"}, {"lessThan": "c1c8550e70401159184130a1afc6261db01fc0ce", "status": "affected", "version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c", "versionType": "git"}, {"status": "affected", "version": "cc7c2818c71ebace207df40cc586c8c74e3d1a59", "versionType": "git"}, {"status": "affected", "version": "ec0cddcc2454ab08193beb473978f8f8889b7e24", "versionType": "git"}, {"lessThan": "5.10.253", "status": "affected", "version": "5.10.85", "versionType": "semver"}, {"lessThan": "5.15.203", "status": "affected", "version": "5.15.8", "versionType": "semver"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.221", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.165", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/host/xhci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.167", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.130", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.78", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.19", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "901C8646-1860-4CD8-B70D-C02E4CAD5E2F", "versionEndExcluding": "4.20", "versionStartIncluding": "4.19.221", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "86894268-9F63-47BD-A035-219EBC359D4E", "versionEndExcluding": "5.5", "versionStartIncluding": "5.4.165", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C5B6032E-F367-42A0-9B64-BE8D27AA93C8", "versionEndExcluding": "5.10.253", "versionStartIncluding": "5.10.85", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "67ECAE40-42E2-489F-9E3A-EE55CD5D9A2F", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.15.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2EDC6BAF-B710-4E26-B6AA-D68922EE7B43", "versionEndExcluding": "6.1.167", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "28D591F5-B196-4CC9-905C-DC80F116E7A8", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D394AC60-6F28-435F-872A-CCDF384B8331", "versionEndExcluding": "6.18.19", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix memory leak in xhci_disable_slot()\n\nxhci_alloc_command() allocates a command structure and, when the\nsecond argument is true, also allocates a completion structure.\nCurrently, the error handling path in xhci_disable_slot() only frees\nthe command structure using kfree(), causing the completion structure\nto leak.\n\nUse xhci_free_command() instead of kfree(). xhci_free_command() correctly\nfrees both the command structure and the associated completion structure.\nSince the command structure is allocated with zero-initialization,\ncommand->in_ctx is NULL and will not be erroneously freed by\nxhci_free_command().\n\nThis bug was found using an experimental static analysis tool we are\ndeveloping. The tool is based on the LLVM framework and is specifically\ndesigned to detect memory management issues. It is currently under\nactive development and not yet publicly available, but we plan to\nopen-source it after our research is published.\n\nThe bug was originally detected on v6.13-rc1 using our static analysis\ntool, and we have verified that the issue persists in the latest mainline\nkernel.\n\nWe performed build testing on x86_64 with allyesconfig using GCC=11.4.0.\nSince triggering these error paths in xhci_disable_slot() requires specific\nhardware conditions or abnormal state, we were unable to construct a test\ncase to reliably trigger these specific error paths at runtime."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: xhci: Correcci\u00f3n de fuga de memoria en xhci_disable_slot()\n\nxhci_alloc_command() asigna una estructura de comando y, cuando el segundo argumento es verdadero, tambi\u00e9n asigna una estructura de completado. Actualmente, la ruta de manejo de errores en xhci_disable_slot() solo libera la estructura de comando usando kfree(), causando la fuga de la estructura de completado.\n\nUse xhci_free_command() en lugar de kfree(). xhci_free_command() libera correctamente tanto la estructura de comando como la estructura de completado asociada. Dado que la estructura de comando se asigna con inicializaci\u00f3n a cero, command -> in_ctx es NULL y no ser\u00e1 liberado err\u00f3neamente por xhci_free_command().\n\nEste error fue encontrado usando una herramienta experimental de an\u00e1lisis est\u00e1tico que estamos desarrollando. La herramienta se basa en el framework LLVM y est\u00e1 espec\u00edficamente dise\u00f1ada para detectar problemas de gesti\u00f3n de memoria. Actualmente est\u00e1 en desarrollo activo y a\u00fan no est\u00e1 disponible p\u00fablicamente, pero planeamos liberarlo como c\u00f3digo abierto despu\u00e9s de que se publique nuestra investigaci\u00f3n.\n\nEl error fue detectado originalmente en v6.13-rc1 usando nuestra herramienta de an\u00e1lisis est\u00e1tico, y hemos verificado que el problema persiste en el \u00faltimo kernel principal.\n\nRealizamos pruebas de compilaci\u00f3n en x86_64 con allyesconfig usando GCC=11.4.0. Dado que activar estas rutas de error en xhci_disable_slot() requiere condiciones de hardware espec\u00edficas o un estado anormal, no pudimos construir un caso de prueba para activar de forma fiable estas rutas de error espec\u00edficas en tiempo de ejecuci\u00f3n."}], "id": "CVE-2026-43432", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43432", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T15:38:24.180135Z", "version": "2.0.3"}}]}, "published": "2026-05-08T15:16:55.470", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/078b446efc0f5e496c31bccb72b98af979963a83"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1e800e26d54ccf2ddf2ea6d6cbe021c804d8aa62"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2e2baa8fb5aa4d080cbfeb84c51eff797529f413"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/46aea90763832cd6e9b0c2e1c00e6a9512156d4b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6288baf0c8c4dcfbf206773aede9c1f2269cec28"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/807e4fb5140c73eb5dba1e399a990db5c1f3cdf8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c1c8550e70401159184130a1afc6261db01fc0ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c65f1b840ab8ce72ba68f1b63bab7960f8fdfa89"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: usb: xhci: Fix memory leak in xhci_disable_slot()", "id": "2468180", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468180"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-763", "details": ["A flaw was found in the Linux kernel's USB xHCI host controller driver. The error handling path in the `xhci_disable_slot()` function incorrectly frees only a portion of the allocated memory, leading to a memory leak of the completion structure. This issue, which can be triggered under specific hardware conditions or abnormal states, may lead to resource exhaustion and potentially a Denial of Service (DoS)."], "name": "CVE-2026-43432", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43432\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43432\nhttps://lore.kernel.org/linux-cve-announce/2026050851-CVE-2026-43432-18dd@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fee8be5bde562d4f5f9a100ca80c6d7072ed34c8,1e800e26d54ccf2ddf2ea6d6cbe021c804d8aa62)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[02d5a2a48bb44e7404b794df87e57588b2fd604e,6288baf0c8c4dcfbf206773aede9c1f2269cec28)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7faac1953ed1f658f719cdf7bb7303fa5eef822c,46aea90763832cd6e9b0c2e1c00e6a9512156d4b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7faac1953ed1f658f719cdf7bb7303fa5eef822c,2e2baa8fb5aa4d080cbfeb84c51eff797529f413)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7faac1953ed1f658f719cdf7bb7303fa5eef822c,807e4fb5140c73eb5e399a990db5c1f3cdf8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7faac1953ed1f658f719cdf7bb7303fa5eef822c,c65f1b840ab8ce72ba68f1b63bab7960f8fdfa89)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7faac1953ed1f658f719cdf7bb7303fa5eef822c,078b446efc0f5e496c31bccb72b98af979963a83)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7faac1953ed1f658f719cdf7bb7303fa5eef822c,c1c8550e70401159184130a1afc6261db01fc0ce)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "cc7c2818c71ebace207df40cc586c8c74e3d1a59"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "ec0cddcc2454ab08193beb473978f8f8889b7e24"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.253,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.203,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.167,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.130,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.78,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.19,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.9,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T18:15:13.669231+00:00", "updated": "2026-05-20T19:30:37.779663+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}