CVE-2026-43342 usb: gadget: f_rndis: Protect RNDIS options with mutex
A race condition in the Linux kernel's RNDIS gadget driver allows concurrent access to configuration options, potentially leading to undefined behavior.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43342?
CVE-2026-43342 is a medium-severity vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_rndis: Protect RNDIS options with mutex
The class/subclass/protocol options are suspectible to race conditions as they can be accessed concurrently through configfs.
Use existing mutex to protect these options. This issue was identified during code inspection.
Weakness: CWE-362
Which versions are affected by CVE-2026-43342?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43342?
Apply the vendor's patch.
Is CVE-2026-43342 being exploited?
There is no known exploitation of CVE-2026-43342 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43342, DEBIAN-CVE-2026-43342, GHSA-pfm7-36qc-84v9, ROOT-OS-DEBIAN-11-CVE-2026-43342, ROOT-OS-UBUNTU-2204-CVE-2026-43342, ROOT-OS-UBUNTU-2404-CVE-2026-43342 and 1 more.