CVE-2026-43327

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

USB: dummy-hcd: Fix locking/synchronization error

Syzbot testing was able to provoke an addressing exception and crash

in the usb_gadget_udc_reset() routine in

drivers/usb/gadgets/udc/core.c, resulting from the fact that the

routine was called with a second ("driver") argument of NULL. The bad

caller was set_link_state() in dummy_hcd.c, and the problem arose

because of a race between a USB reset and driver unbind.

These sorts of races were not supposed to be possible; commit

7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change"),

along with a few followup commits, was written specifically to prevent

them. As it turns out, there are (at least) two errors remaining in

the code. Another patch will address the second error; this one is

concerned with the first.

The error responsible for the syzbot crash occurred because the

stop_activity() routine will sometimes drop and then re-acquire the

dum->lock

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References