CVE-2026-43428: Linux Kernel USB Core DoS Vulnerability

CVE-2026-43428 Overview

CVE-2026-43428 is a denial-of-service vulnerability in the Linux kernel USB core (usbcore). The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs accepted unlimited timeout durations while using uninterruptible waits. A task issuing one of these synchronous USB transfers could hang indefinitely, with no signal capable of terminating it short of unplugging the target device. The upstream fix caps these unkillable timeouts at 60 seconds and treats negative timeout values the same as zero, which selects the maximum allowed timeout.

Critical Impact
Kernel tasks waiting on USB synchronous transfers could become permanently stuck in uninterruptible sleep, potentially triggering the kernel hung-task detector and degrading system availability.

Affected Products

Linux kernel — USB core subsystem (drivers/usb/core/message.c)
Kernel callers of usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg()
Multiple stable kernel branches, as indicated by the eight stable-tree backport commits

Discovery Timeline

2026-05-08 - CVE-2026-43428 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43428

Vulnerability Analysis

The Linux USB core exposes three synchronous transfer helpers used by countless USB drivers: usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg(). Each accepts a caller-supplied timeout parameter and waits for transfer completion using an uninterruptible sleep. Because the wait is uninterruptible, signals — including SIGKILL — cannot break the calling task out of the wait. A misbehaving or malicious USB device that never completes the requested transfer can therefore park the calling thread for the full timeout duration. When drivers pass very large timeouts, or negative values that were interpreted as effectively unlimited, the task becomes unkillable for an arbitrary period.

Root Cause

The root cause is missing input bounding on the timeout argument inside usbcore. The APIs trusted caller-supplied values without enforcing an upper bound, and the semantics of negative values were ambiguous. Combined with the uninterruptible wait, this allowed a single stalled USB transfer to hold a kernel task hostage and eventually trip the kernel hung-task watchdog on systems with default thresholds.

Attack Vector

Exploitation requires a USB device — physical or emulated — that fails to complete a transfer initiated by a driver using one of the affected synchronous APIs. A locally connected malicious or faulty device can cause the driver thread to remain in uninterruptible sleep, producing denial-of-service conditions. The fix introduces a 60-second cap on these unkillable timeouts, short enough on most systems to avoid the kernel hung-task detector, and normalizes negative timeout values to mean "use the maximum allowed timeout." Technical details are available in the upstream patches, including Linux Kernel Commit 06d2bbc and Linux Kernel Commit 1015c27.

Detection Methods for CVE-2026-43428

Indicators of Compromise

Kernel log messages from the hung-task detector referencing tasks blocked in usb_control_msg, usb_bulk_msg, or usb_interrupt_msg call paths.
Processes stuck in uninterruptible sleep (D state) with stack traces pointing to usbcore synchronous transfer helpers.
Repeated USB device enumeration failures or transfer stalls preceding the hang.

Detection Strategies

Monitor dmesg and /var/log/kern.log for INFO: task <name>:<pid> blocked for more than N seconds entries that reference USB transfer functions.
Audit running kernel versions across the fleet to identify hosts on stable branches that have not received the backported fix.
Track unexpected USB device attach events on servers and workstations where USB peripherals are not normally connected.

Monitoring Recommendations

Forward kernel ring buffer events into a centralized logging pipeline so hung-task warnings are correlated with USB subsystem messages.
Alert on sustained increases in tasks in uninterruptible sleep state on production hosts.
Inventory USB device connect and disconnect activity at the endpoint level to investigate anomalous local device usage.

How to Mitigate CVE-2026-43428

Immediate Actions Required

Apply the upstream stable-tree updates that include the USB core timeout cap on all affected kernels.
Restrict physical and virtual access to USB ports on critical systems, including servers, build infrastructure, and lab hosts.
Disable or unload kernel drivers for USB device classes that are not required for the host's role.

Patch Information

The fix has been merged across multiple stable branches via the following commits: 06d2bbc, 1015c27, 24b31a2, 2d34cb4, 4e86f5b, 64f3d75, 659c0c7, and 6c62935. Consume the fix through your distribution's kernel package rather than cherry-picking where possible. The EPSS score is 0.032% as of 2026-05-17, indicating very low predicted exploitation in the wild, but availability impact on multi-tenant or kiosk systems still warrants timely patching.

Workarounds

Enforce USB device control policies (for example, USBGuard) to allow only known device IDs to attach.
Physically lock or disable USB ports on systems that do not require user-connected peripherals.
For embedded and appliance deployments, blacklist unused USB driver modules to shrink the attack surface.

bash

# Example: block all USB devices by default with USBGuard and allow only approved IDs
sudo apt install usbguard
sudo usbguard generate-policy > /etc/usbguard/rules.conf
sudo systemctl enable --now usbguard
# Review and tighten /etc/usbguard/rules.conf to allow only required vendor:product IDs