CVE-2026-43223 Overview
CVE-2026-43223 is a Linux kernel vulnerability in the pvrusb2 media driver. The flaw resides in the pvr2_send_request_ex() function, which manages USB Request Blocks (URBs) for communication with Hauppauge PVR USB2 devices. When the function submits a write URB successfully but fails to submit the subsequent read URB (for example, when memory allocation returns -ENOMEM), it returns immediately without unlinking or waiting for the in-flight write URB. Because the driver reuses the same URB structure, the next call attempts to resubmit a still-active URB, triggering a URB submitted while active warning in usb_submit_urb().
Critical Impact
The URB leak can produce kernel warnings, driver instability, and potential resource exhaustion on systems using pvrusb2 USB capture devices.
Affected Products
- Linux kernel (mainline) with the pvrusb2 media driver enabled
- Stable kernel branches receiving the backported fix across multiple commits
- Distributions shipping unpatched drivers/media/usb/pvrusb2 code
Discovery Timeline
- 2026-05-06 - CVE-2026-43223 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43223
Vulnerability Analysis
The pvrusb2 driver in drivers/media/usb/pvrusb2 performs paired write-then-read USB transactions through pvr2_send_request_ex(). The function allocates and submits a write URB, then submits a read URB to retrieve the device response. Both URBs share persistent driver-owned structures rather than per-call allocations.
When usb_submit_urb() succeeds for the write URB but the subsequent read URB submission fails, the function exits the error path without calling usb_unlink_urb() on the write URB and without waiting for its completion. The write URB remains active in the USB core. Any later invocation of pvr2_send_request_ex() reuses that same URB structure and calls usb_submit_urb() on it again, which triggers the kernel's URB submitted while active WARN and skips the transfer.
Root Cause
The root cause is missing error-path cleanup [CWE-404 Improper Resource Shutdown or Release]. The driver assumed both submissions succeed atomically, leaving no rollback for the partial-success case. The fix unlinks the write URB and waits for completion when the read URB submission fails, restoring the URB structure to an idle state before return.
Attack Vector
The vulnerability is reachable through normal driver operation against a pvrusb2-supported capture device. Triggering the failure path requires the read URB submission to fail, typically under memory pressure. Successful exploitation does not yield code execution. The realistic impact is local denial of service and driver malfunction on systems with the affected hardware attached.
No public proof-of-concept or exploit code is available, and CVE-2026-43223 is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-43223
Indicators of Compromise
- Kernel ring buffer messages containing URB submitted while active originating from usb_submit_urb()
- Repeated pvr2_send_request_ex failures or -ENOMEM returns in dmesg output
- Unresponsive Hauppauge PVR USB2 capture devices after transient memory pressure
Detection Strategies
- Monitor kernel logs on hosts with pvrusb2 loaded for WARN traces referencing usb_submit_urb
- Audit installed kernel package versions against the patched stable releases referenced in the kernel.org commits
- Track lsmod output across the fleet to identify systems where the pvrusb2 module is loaded
Monitoring Recommendations
- Forward /var/log/kern.log and journalctl -k output to centralized logging for WARN and -ENOMEM correlation
- Alert on repeated USB subsystem warnings tied to media drivers on production capture or broadcast hosts
- Include kernel version drift detection in configuration management to surface unpatched nodes
How to Mitigate CVE-2026-43223
Immediate Actions Required
- Update to a Linux kernel that includes the pvr2_send_request_ex URB-leak fix from the upstream stable tree
- Unload the pvrusb2 module on systems that do not require Hauppauge USB capture functionality using modprobe -r pvrusb2
- Inventory hosts with the module loaded and prioritize patching for systems with the affected USB hardware attached
Patch Information
The fix has been merged across mainline and multiple stable branches. Reference commits include Kernel Git Commit 2011929, Kernel Git Commit 4ba5c7a, Kernel Git Commit 58dd722, Kernel Git Commit 5f3ac81, Kernel Git Commit 77a63f8, Kernel Git Commit a8333c8, Kernel Git Commit cf459d6, and Kernel Git Commit da524c9. The change ensures the write URB is unlinked and waited upon when the read URB submission fails.
Workarounds
- Blacklist the pvrusb2 module on systems that do not need Hauppauge USB capture support by adding blacklist pvrusb2 to /etc/modprobe.d/
- Physically disconnect affected USB capture devices on unpatched systems to prevent driver invocation
- Reduce memory pressure on hosts using the driver to lower the probability of read URB allocation failures until patching is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
