CVE-2026-43327 USB: dummy-hcd: Fix locking/synchronization error
A race condition in the Linux kernel USB dummy-hcd driver allows a local attacker to trigger a system crash via a null pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43327?
CVE-2026-43327 is a medium-severity vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
USB: dummy-hcd: Fix locking/synchronization error
Syzbot testing was able to provoke an addressing exception and crash in the usb_gadget_udc_reset() routine in drivers/usb/gadgets/udc/core.c, resulting from the fact that the routine was called with a second ("driver") argument of NULL. The bad caller was set_link_state() in dummy_hcd.c, and the problem arose because of a race between a USB reset and driver unbind.
These sorts of races were not supposed to be possible; commit 7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change"), along with a few followup commits, was written specifically to prevent them. As it turns out, there are (at least) two errors remaining in the code. Another patch will address the second error; this one is concerned with the first.
The error responsible for the syzbot crash occurred because the stop_activity() routine will sometimes drop and then re-acquire the dum->lock spinlock. A call to stop_activity() occurs in set_link_state() when handling an emulated USB reset, after the test of dum->ints_enabled and before the increment of dum->callback_usage. This allowed another thread (doing a driver unbind) to sneak in and grab the spinlock, and then clear dum->ints_enabled and dum->driver. Normally this other thread would have to wait for dum->callback_usage to go down to 0 before it would clear dum->driver, but in this case it didn't have to wait since dum->callback_usage had not yet been incremented.
The fix is to increment dum->callback_usage _before_ calling stop_activity() instead of after. Then the thread doing the unbind will not clear dum->driver until after the call to usb_gadget_udc_reset() safely returns and dum->callback_usage has been decremented again.
Weakness: CWE-667
Which versions are affected by CVE-2026-43327?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43327?
Apply the vendor's patch.
Is CVE-2026-43327 being exploited?
There is no known exploitation of CVE-2026-43327 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43327, DEBIAN-CVE-2026-43327, GHSA-mhgr-c53r-gx3p, ROOT-OS-DEBIAN-11-CVE-2026-43327, ROOT-OS-UBUNTU-2204-CVE-2026-43327, ROOT-OS-UBUNTU-2404-CVE-2026-43327 and 1 more.