CVE-2026-43429: Linux Kernel USB USBTMC DOS Vulnerability

CVE-2026-43429 Overview

CVE-2026-43429 affects the Linux kernel's USB Test and Measurement Class (usbtmc) driver. The driver accepts user-supplied timeout values through an ioctl command and forwards them to usb_bulk_msg() calls. Because usb_bulk_msg() performs an unkillable wait, a user can specify an arbitrarily long timeout and hang a kernel thread indefinitely. The fix replaces these calls with usb_bulk_msg_killable(), allowing signals to interrupt the wait. The issue was addressed across multiple stable kernel branches via the referenced commits.

Critical Impact
A local user can issue an ioctl with an excessive timeout to cause a kernel thread to wait in an uninterruptible state, leading to a denial-of-service condition on the affected system.

Affected Products

Linux kernel usbtmc driver (drivers/usb/class/usbtmc.c)
Multiple stable Linux kernel branches receiving the backported fix
Systems exposing USB Test and Measurement Class devices to unprivileged users

Discovery Timeline

2026-05-08 - CVE-2026-43429 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43429

Vulnerability Analysis

The usbtmc driver implements an ioctl interface that allows userspace applications to configure timeout values used during USB bulk transfers. These user-supplied timeouts are then passed to usb_bulk_msg(), the kernel helper that performs synchronous bulk endpoint I/O. usb_bulk_msg() waits for completion in an uninterruptible state, meaning the calling thread cannot be killed or signaled while the wait is active. When a userspace caller specifies an arbitrarily large timeout value, the kernel thread servicing that request becomes stuck for the duration of the timeout and cannot be terminated through normal signaling. This affects process termination, system shutdown sequences, and overall system responsiveness. The fix substitutes usb_bulk_msg_killable(), a variant that performs the wait in a killable state and allows fatal signals to interrupt the operation.

Root Cause

The root cause is the use of an uninterruptible wait primitive (usb_bulk_msg()) in a code path that consumes attacker-controlled timeout values. The driver does not clamp or validate the timeout against a maximum bound, and the underlying synchronous wait does not respond to SIGKILL. This combination produces a denial-of-service condition classified as a resource exhaustion and kernel-state issue.

Attack Vector

Exploitation requires local access to a system with a usbtmc character device node (typically /dev/usbtmc*) accessible to the attacker. The attacker opens the device, issues the timeout-configuring ioctl with a very large value, and then triggers a bulk transfer operation. The kernel thread handling the transfer enters an unkillable wait, persisting until the timeout naturally expires or the underlying USB transfer completes. Patch details are available in the referenced Kernel Git Commit 0535f84 and related commits.

Detection Methods for CVE-2026-43429

Indicators of Compromise

Processes that interact with /dev/usbtmc* device nodes and remain in the D (uninterruptible sleep) state for prolonged periods
Kernel log entries referencing usbtmc combined with hung task warnings from the khungtaskd watchdog
Unusual ioctl activity targeting USB Test and Measurement Class devices from non-administrative users

Detection Strategies

Monitor /proc/<pid>/stat and /proc/<pid>/wchan for tasks blocked in usb_bulk_msg-related wait functions for unusually long intervals
Enable and review hung_task_timeout_secs warnings in dmesg to surface threads stuck in uninterruptible sleep within USB code paths
Audit ioctl syscalls against usbtmc file descriptors using auditd rules or eBPF tracing to identify abnormally large timeout parameters

Monitoring Recommendations

Track running kernel versions across the fleet and compare against the fixed commits listed in the kernel.org references
Alert on repeated hung task reports involving USB driver stacks, which often signal driver-level abuse or hardware faults
Inventory hosts that expose USB Test and Measurement Class devices to unprivileged users, as these are the realistic exposure surface

How to Mitigate CVE-2026-43429

Immediate Actions Required

Apply the upstream stable kernel update containing the usbtmc fix on all affected branches
Restrict access to /dev/usbtmc* device nodes to trusted users only, using filesystem permissions or udev rules
Unload the usbtmc kernel module on systems that do not require USB Test and Measurement Class functionality

Patch Information

The fix replaces usb_bulk_msg() with usb_bulk_msg_killable() in the usbtmc driver, ensuring that user-controlled timeouts no longer place kernel threads in unkillable waits. The change is distributed across multiple stable kernel branches via commits including 0535f84, 39bd409, 6cb7dc9, 72c0a06, 7784caa, 7fa72c3, d4f1c45, and e14a0dc. Distribution-specific advisories should be consulted for backport status.

Workarounds

Blacklist the usbtmc module via /etc/modprobe.d/ configuration on systems that do not need test and measurement device support
Apply strict udev rules to limit /dev/usbtmc* access to a dedicated group of trusted operators
Avoid granting unprivileged users access to USB Test and Measurement Class devices until patched kernels are deployed

bash

# Blacklist the usbtmc module to remove the attack surface
echo "blacklist usbtmc" | sudo tee /etc/modprobe.d/blacklist-usbtmc.conf
sudo modprobe -r usbtmc

# Restrict device node access via udev (example)
# /etc/udev/rules.d/99-usbtmc.rules
# SUBSYSTEM=="usbmisc", KERNEL=="usbtmc*", MODE="0600", OWNER="root"
sudo udevadm control --reload-rules