CVE-2026-43427 (GCVE-0-2026-43427)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: class: cdc-wdm: fix reordering issue in read code path
Quoting the bug report:
Due to compiler optimization or CPU out-of-order execution, the
desc->length update can be reordered before the memmove. If this
happens, wdm_read() can see the new length and call copy_to_user() on
uninitialized memory. This also violates LKMM data race rules [1].
Fix it by using WRITE_ONCE and memory barriers.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: afba937e540c902c989cd516fd97ea0c8499bb27 Version: afba937e540c902c989cd516fd97ea0c8499bb27 Version: afba937e540c902c989cd516fd97ea0c8499bb27 Version: afba937e540c902c989cd516fd97ea0c8499bb27 Version: afba937e540c902c989cd516fd97ea0c8499bb27 Version: afba937e540c902c989cd516fd97ea0c8499bb27 Version: afba937e540c902c989cd516fd97ea0c8499bb27 Version: afba937e540c902c989cd516fd97ea0c8499bb27 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/class/cdc-wdm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "638328ca9c17ae6511ad62198c57bae32ffa3c91",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
},
{
"lessThan": "170e8daca24da6edb4be82ab01abf44e87af387b",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
},
{
"lessThan": "c8fa96ed021923dae147bcd9f9205b8df7b82360",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
},
{
"lessThan": "4ee3062bf2c9a722afef429826e8607eaf3fc6a0",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
},
{
"lessThan": "276aef0fd2b92f41b920ac891c72cadeee957934",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
},
{
"lessThan": "67ed312124bb1b61858778ac0b985b48961c862a",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
},
{
"lessThan": "e3c874b05901dc519054b5107d16620e6d2b5fea",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
},
{
"lessThan": "8df672bfe3ec2268c2636584202755898e547173",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/class/cdc-wdm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: class: cdc-wdm: fix reordering issue in read code path\n\nQuoting the bug report:\n\nDue to compiler optimization or CPU out-of-order execution, the\ndesc-\u003elength update can be reordered before the memmove. If this\nhappens, wdm_read() can see the new length and call copy_to_user() on\nuninitialized memory. This also violates LKMM data race rules [1].\n\nFix it by using WRITE_ONCE and memory barriers."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:22.781Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/638328ca9c17ae6511ad62198c57bae32ffa3c91"
},
{
"url": "https://git.kernel.org/stable/c/170e8daca24da6edb4be82ab01abf44e87af387b"
},
{
"url": "https://git.kernel.org/stable/c/c8fa96ed021923dae147bcd9f9205b8df7b82360"
},
{
"url": "https://git.kernel.org/stable/c/4ee3062bf2c9a722afef429826e8607eaf3fc6a0"
},
{
"url": "https://git.kernel.org/stable/c/276aef0fd2b92f41b920ac891c72cadeee957934"
},
{
"url": "https://git.kernel.org/stable/c/67ed312124bb1b61858778ac0b985b48961c862a"
},
{
"url": "https://git.kernel.org/stable/c/e3c874b05901dc519054b5107d16620e6d2b5fea"
},
{
"url": "https://git.kernel.org/stable/c/8df672bfe3ec2268c2636584202755898e547173"
}
],
"title": "usb: class: cdc-wdm: fix reordering issue in read code path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43427",
"datePublished": "2026-05-08T14:22:00.345Z",
"dateReserved": "2026-05-01T14:12:56.009Z",
"dateUpdated": "2026-05-11T22:24:22.781Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…