CVE-2026-43425 usb: image: mdc800: kill download URB on timeout
A race condition in the mdc800 USB driver allows a local attacker to trigger a kernel warning and potential denial of service by resubmitting an active URB after a timeout.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43425?
CVE-2026-43425 is a medium-severity vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: image: mdc800: kill download URB on timeout
mdc800_device_read() submits download_urb and waits for completion. If the timeout fires and the device has not responded, the function returns without killing the URB, leaving it active.
A subsequent read() resubmits the same URB while it is still in-flight, triggering the WARN in usb_submit_urb():
"URB submitted while active"
Check the return value of wait_event_timeout() and kill the URB if it indicates timeout, ensuring the URB is complete before its status is inspected or the URB is resubmitted.
Similar to - commit 372c93131998 ("USB: yurex: fix control-URB timeout handling") - commit b98d5000c505 ("media: rc: iguanair: handle timeouts")
Which versions are affected by CVE-2026-43425?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43425?
Apply the vendor's patch.
Is CVE-2026-43425 being exploited?
There is no known exploitation of CVE-2026-43425 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43425, DEBIAN-CVE-2026-43425, GHSA-mvvm-h9gx-gvqm, ROOT-OS-DEBIAN-11-CVE-2026-43425, ROOT-OS-UBUNTU-2204-CVE-2026-43425, ROOT-OS-UBUNTU-2404-CVE-2026-43425 and 1 more.