CVE-2026-43375: Linux Kernel Privilege Escalation Flaw

CVE-2026-43375 Overview

CVE-2026-43375 is a memory leak vulnerability in the Linux kernel's Management Component Transport Protocol (MCTP) over USB driver. The flaw exists in the driver's probe function, which takes an unnecessary reference to the parent USB device but fails to release that reference if probe fails. The driver core already holds a reference to the USB interface and its parent USB device while the interface is bound to a driver, making the additional reference redundant. Repeated probe failures progressively exhaust kernel memory, leading to availability impact on affected systems. The issue is tracked under CWE-401 (Missing Release of Memory after Effective Lifetime).

Critical Impact
A local attacker capable of triggering repeated MCTP-over-USB driver probe failures can leak kernel device references, exhausting memory and causing denial of service.

Affected Products

Linux Kernel 7.0-rc1
Linux Kernel 7.0-rc2
Linux Kernel 7.0-rc3

Discovery Timeline

2026-05-08 - CVE-2026-43375 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43375

Vulnerability Analysis

The vulnerability resides in the Linux kernel net/mctp USB driver responsible for transporting MCTP frames over USB interfaces. The driver's probe routine acquires an additional reference on the underlying USB device via the kernel's reference counting machinery. This reference is intended to keep the device structure alive while the driver operates on it. However, the driver core already maintains an active reference to the USB interface and, transitively, to the parent USB device for the entire duration the interface is bound to the driver. The extra reference is therefore redundant.

The defect manifests when probe fails partway through initialization. On the failure path, the driver does not drop the reference it acquired, leaking the device structure for the lifetime of the kernel. Each failed probe attempt consumes additional kernel memory that is never reclaimed.

Root Cause

The root cause is improper resource lifecycle management classified as [CWE-401]. The driver takes a usb_get_dev()-style reference without a corresponding release on error paths in probe. The upstream fix removes the redundant reference acquisition entirely rather than adding a release call, eliminating the leak and aligning the driver with kernel reference-counting conventions.

Attack Vector

Exploitation requires local access with the ability to influence USB device enumeration or trigger driver probe operations. An attacker with physical access to a USB port or control over a virtualized USB endpoint can repeatedly induce probe failures against the MCTP USB driver. Each failure consumes a small amount of non-reclaimable kernel memory. Sustained exploitation produces resource exhaustion and degrades or halts system availability. The vulnerability does not permit code execution or information disclosure.

No synthetic exploit code is provided. Refer to the upstream commits for the precise code paths: Kernel commit 224a0d28, commit 3224990f, and commit ec9538f9.

Detection Methods for CVE-2026-43375

Indicators of Compromise

Repeated mctp driver probe failure messages in dmesg or journalctl output correlated with USB device enumeration events.
Steady growth in kernel Slab memory reported by /proc/meminfo without a corresponding increase in user-space workload.
Anomalous USB attach and detach cycles from a single device, particularly targeting MCTP-class interfaces.

Detection Strategies

Monitor kernel ring buffer logs for MCTP USB probe errors and correlate with USB hotplug events using udev audit rules.
Track kernel memory consumption trends over time and alert when slab allocations grow without corresponding workload changes.
Compare running kernel version against the patched stable branches identified in the upstream commits.

Monitoring Recommendations

Forward dmesg, journald, and udev events to a centralized log platform for longitudinal analysis of USB driver activity.
Establish baselines for kernel slab memory and alert on sustained upward drift on long-running hosts.
Audit USB port access controls on multi-user systems and kiosks where physical access is feasible.

How to Mitigate CVE-2026-43375

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the vendor advisory commits as soon as distribution updates become available.
Inventory hosts running Linux kernel 7.0-rc1 through 7.0-rc3 and prioritize patching for systems exposed to untrusted USB devices.
Restrict physical access to USB ports on servers, workstations, and embedded systems where MCTP over USB is enabled.

Patch Information

The fix removes the redundant usb_get_dev() reference acquisition from the MCTP USB driver probe path. Patched commits are available in the mainline and stable trees: 224a0d284c3c, 3224990fb16a, and ec9538f9b5cd. Rebuild or update to a kernel containing these commits.

Workarounds

Blacklist the mctp_usb kernel module on systems that do not require MCTP-over-USB functionality using /etc/modprobe.d/ configuration.
Disable unused USB controllers in firmware or via kernel command line parameters on systems where USB is not required.
Use USB device authorization policies through /sys/bus/usb/devices/*/authorized to permit only known device classes.

bash

# Disable loading of the MCTP USB driver if not required
echo 'blacklist mctp_usb' | sudo tee /etc/modprobe.d/disable-mctp-usb.conf
sudo update-initramfs -u

# Restrict USB device authorization by default on a given controller
echo 0 | sudo tee /sys/bus/usb/devices/usb1/authorized_default