CVE-2026-43327: Linux Kernel Race Condition Vulnerability

CVE-2026-43327 Overview

CVE-2026-43327 is a locking and synchronization flaw in the Linux kernel's USB dummy-hcd driver. The bug lives in drivers/usb/gadget/udc/dummy_hcd.c and core.c, where set_link_state() calls stop_activity() while holding dum->lock. The stop_activity() routine temporarily drops and reacquires the spinlock, opening a race window between an emulated USB reset and a concurrent driver unbind. A second thread can clear dum->driver before dum->callback_usage is incremented, causing usb_gadget_udc_reset() to be called with a NULL driver pointer. Syzbot reproduced the resulting addressing exception and kernel crash. The flaw is tracked under [CWE-667: Improper Locking].

Critical Impact
A local attacker with the ability to trigger USB gadget operations can crash the kernel through a NULL pointer dereference, resulting in denial of service.

Affected Products

Linux Kernel (multiple stable branches prior to the fix)
Linux Kernel 7.0 release candidates rc1 through rc7
Systems built with CONFIG_USB_DUMMY_HCD enabled

Discovery Timeline

2026-05-08 - CVE-2026-43327 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43327

Vulnerability Analysis

The vulnerability is a race condition in the Linux kernel USB gadget subsystem's dummy-hcd driver. set_link_state() handles emulated USB reset events on the dummy host controller. During reset processing, it tests dum->ints_enabled, calls stop_activity(), and then increments the dum->callback_usage reference counter. The ordering of these steps is the source of the bug.

Prior commits, including 7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change"), introduced the callback_usage counter to serialize callbacks against driver unbind. Driver unbind paths wait for dum->callback_usage to reach zero before clearing dum->driver. That contract is broken when stop_activity() releases the spinlock before the counter has been raised.

Root Cause

The stop_activity() helper drops dum->lock to invoke gadget callbacks, then reacquires it. Because set_link_state() increments dum->callback_usage only after stop_activity() returns, a parallel unbind thread can acquire dum->lock in the gap. The unbind path sees callback_usage == 0, clears dum->ints_enabled and dum->driver, and exits. When set_link_state() resumes and eventually calls usb_gadget_udc_reset() in drivers/usb/gadget/udc/core.c, the driver argument is NULL, producing an addressing exception.

Attack Vector

Exploitation requires local access and the ability to interact with the USB gadget configfs interface or otherwise trigger reset and unbind operations on a dummy-hcd instance. The attack is timing-sensitive and matches the conditions Syzbot uncovered through kernel fuzzing. Successful exploitation crashes the kernel and produces a denial of service on the affected host. There is no confidentiality or integrity impact, and no public proof-of-concept exploit is currently available.

The upstream fix reorders the operations in set_link_state() so that dum->callback_usage is incremented before stop_activity() is called. This guarantees that any concurrent unbind thread observes a non-zero usage count and waits before clearing dum->driver, ensuring usb_gadget_udc_reset() always receives a valid driver pointer.

Detection Methods for CVE-2026-43327

Indicators of Compromise

Kernel oops or panic logs referencing usb_gadget_udc_reset or set_link_state in stack traces
Crash messages citing NULL pointer dereference inside drivers/usb/gadget/udc/core.c
Unexpected reboots on systems with CONFIG_USB_DUMMY_HCD enabled and active gadget configfs use

Detection Strategies

Inventory running kernels with package management tools and compare against the fixed commits referenced in the kernel.org stable tree.
Audit kernel build configurations for CONFIG_USB_DUMMY_HCD=y or =m, which indicates exposure to the vulnerable code path.
Monitor dmesg and journald for repeated USB gadget reset or unbind errors that may precede a crash.

Monitoring Recommendations

Forward kernel crash dumps and kdump artifacts to a central log store for stack-trace analysis.
Alert on processes that repeatedly bind and unbind USB gadget drivers through /sys/kernel/config/usb_gadget/.
Track local user activity that loads the dummy_hcd module on production systems where it is not required.

How to Mitigate CVE-2026-43327

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the vendor advisories and rebuild or update affected kernels.
Restrict local shell and configfs access on systems where dummy-hcd is loaded.
Unload the dummy_hcd module on hosts that do not need USB gadget emulation using modprobe -r dummy_hcd.

Patch Information

The Linux kernel maintainers have backported the fix across multiple stable branches. Relevant commits include cc97fb5969177cccce2e23b31298df220fc7570d, 805b1833d6ed6da5086e610578a28e71bb54fbbb, 791966f85b439b261bf19865cf1c07c065ffb4b4, 69ab97a693251d6a6093e630060a3c744fd58524, 6350c7dd33ab481ef41c931a238361490c32d15c, 616a63ff495df12863692ab3f9f7b84e3fa7a66d, efbd9441f1e769a7aae1813d497cec09cbdff031, and 218886b2ef2dea7627d3700ab0abaf4bf9d1161f. Apply distribution kernel updates that incorporate these commits.

Workarounds

Blacklist the dummy_hcd module on hosts that do not require USB gadget testing.
Limit interactive and SSH access to trusted administrators to reduce the local attack surface.
Disable CONFIG_USB_DUMMY_HCD in custom kernel builds where the driver is not needed.

bash

# Prevent dummy_hcd from loading until a patched kernel is installed
echo 'blacklist dummy_hcd' | sudo tee /etc/modprobe.d/blacklist-dummy-hcd.conf
sudo modprobe -r dummy_hcd 2>/dev/null || true
sudo update-initramfs -u