CVE-2026-43428 USB: core: Limit the length of unkillable synchronous timeouts
Attackers can cause indefinite task hangs in the Linux kernel via USB APIs by exploiting unlimited unkillable synchronous timeouts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43428?
CVE-2026-43428 is a medium-severity denial of service vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
USB: core: Limit the length of unkillable synchronous timeouts
The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in usbcore allow unlimited timeout durations. And since they use uninterruptible waits, this leaves open the possibility of hanging a task for an indefinitely long time, with no way to kill it short of unplugging the target device.
To prevent this sort of problem, enforce a maximum limit on the length of these unkillable timeouts. The limit chosen here, somewhat arbitrarily, is 60 seconds. On many systems (although not all) this is short enough to avoid triggering the kernel's hung-task detector.
In addition, clear up the ambiguity of negative timeout values by treating them the same as 0, i.e., using the maximum allowed timeout.
Which versions are affected by CVE-2026-43428?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43428?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-43428 being exploited?
There is no known exploitation of CVE-2026-43428 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43428, DEBIAN-CVE-2026-43428, GHSA-xwm3-969p-pfmw, ROOT-OS-DEBIAN-11-CVE-2026-43428, ROOT-OS-UBUNTU-2204-CVE-2026-43428, ROOT-OS-UBUNTU-2404-CVE-2026-43428 and 1 more.