CVE-2026-43170 usb: dwc3: gadget: Move vbus draw to workqueue context
A kernel panic occurs in the Linux USB DWC3 gadget driver when VBUS draw operations sleep in atomic context, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43170?
CVE-2026-43170 is a medium-severity denial of service vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: gadget: Move vbus draw to workqueue context
Currently dwc3_gadget_vbus_draw() can be called from atomic context, which in turn invokes power-supply-core APIs. And some these PMIC APIs have operations that may sleep, leading to kernel panic.
Fix this by moving the vbus_draw into a workqueue context.
Which versions are affected by CVE-2026-43170?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43170?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-43170 being exploited?
There is no known exploitation of CVE-2026-43170 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43170, DEBIAN-CVE-2026-43170, GHSA-x976-429q-rjpm, ROOT-OS-DEBIAN-12-CVE-2026-43170, ROOT-OS-UBUNTU-2204-CVE-2026-43170, ROOT-OS-UBUNTU-2404-CVE-2026-43170 and 1 more.