CVE-2026-43424 Overview
CVE-2026-43424 is a NULL pointer dereference vulnerability in the Linux kernel's USB gadget f_tcm driver. The flaw resides in the USB Target Command Module's nexus handling logic, where the tpg->tpg_nexus pointer is dynamically managed through userspace ConfigFS configuration. When a USB host sends Bulk-Only Transport (BOT) commands before the nexus is fully established or immediately after it is dropped, functions like bot_submit_command() dereference tv_nexus->tvn_se_sess without validation. This triggers a kernel panic, resulting in a local denial-of-service condition.
Critical Impact
A malicious or misconfigured USB host can crash the Linux kernel by sending BOT commands during a race window in USB target nexus establishment.
Affected Products
- Linux kernel versions implementing the usb/gadget/function/f_tcm.c driver
- Systems exposing USB Target Command Module functionality via ConfigFS
- Linux distributions shipping affected stable kernel branches prior to the patches referenced below
Discovery Timeline
- 2026-05-08 - CVE-2026-43424 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43424
Vulnerability Analysis
The vulnerability resides in the USB gadget Target Command Module (f_tcm), which implements SCSI target functionality over USB using Bulk-Only Transport (BOT) and USB Attached SCSI (UAS). The tpg->tpg_nexus pointer represents the session nexus binding a USB target port group to a SCSI session. Because ConfigFS allows userspace to create and drop the nexus dynamically, the pointer can be NULL during normal operation.
The BOT command path retrieves tv_nexus = tpg->tpg_nexus and immediately dereferences tv_nexus->tvn_se_sess without checking whether tv_nexus is valid. A USB host that issues commands before the nexus is established, or in the brief window after it is torn down, triggers a kernel NULL pointer dereference and panic.
Root Cause
The root cause is inconsistent NULL-pointer validation across peer functions in the same module. Functions such as usbg_submit_command() and bot_send_bad_response() correctly perform if (!tv_nexus) checks before dereferencing the nexus pointer. The BOT command submission path and data transfer paths omitted this guard, leaving a race window between ConfigFS state changes and USB host activity.
Attack Vector
Exploitation requires a USB host capable of sending BOT requests to a Linux system configured as a USB target. An attacker with physical access, or control over a connected USB host controller, can time SCSI commands to coincide with nexus teardown or pre-establishment states. The result is a local denial of service through kernel panic. Code execution is not indicated by the upstream description.
No verified public proof-of-concept code is available. The fix is described in the upstream kernel patches referenced in the External References, which add the missing if (!tv_nexus) guards and return a graceful error to the BOT command path instead of dereferencing a NULL pointer.
Detection Methods for CVE-2026-43424
Indicators of Compromise
- Unexpected kernel panics or oops messages referencing bot_submit_command, f_tcm, or tvn_se_sess in dmesg or /var/log/kern.log.
- System crashes correlated with USB device connection events on hosts running USB gadget target configurations.
- ConfigFS activity creating or removing tpg_nexus entries shortly before a crash.
Detection Strategies
- Monitor kernel ring buffer and crash dumps for NULL pointer dereference signatures within the drivers/usb/gadget/function/f_tcm.c call path.
- Audit systems for the presence of the usb_f_tcm kernel module and ConfigFS-exported USB target gadgets that are reachable by untrusted USB hosts.
- Correlate kernel crash telemetry with USB hotplug events using endpoint or host-based logging.
Monitoring Recommendations
- Forward kernel logs and crash reports to a centralized log platform for analysis of repeated panics involving USB gadget functions.
- Track installed kernel versions against the fixed commits (2a2ef84, 3d309b3, 679d953, b9b26d7, b9fde50, d146f27, f962ca3) to confirm patch coverage.
- Alert on physical-access events on systems running USB target functionality, particularly in lab, embedded, and storage gateway deployments.
How to Mitigate CVE-2026-43424
Immediate Actions Required
- Apply the upstream kernel patches that introduce if (!tv_nexus) validation in the BOT command and data transfer paths.
- Update to a kernel version that includes one of the fix commits referenced in the Linux stable tree.
- Restrict physical access to systems configured as USB gadget targets until patched.
Patch Information
The vulnerability is resolved upstream by adding consistent NULL checks for tv_nexus in the BOT command submission and request processing paths. Reference the fix commits: Kernel Patch 2a2ef84, Kernel Patch 3d309b3, Kernel Patch 679d953, Kernel Patch b9b26d7, Kernel Patch b9fde50, Kernel Patch d146f27, and Kernel Patch f962ca3.
Workarounds
- Unload the usb_f_tcm kernel module on systems that do not require USB target functionality.
- Avoid tearing down ConfigFS tpg_nexus entries while a USB host is actively connected.
- Use udev or systemd rules to deny USB gadget configuration changes from non-administrative contexts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
