CVE-2026-43430: Linux Kernel USB Race Condition Flaw

CVE-2026-43430 Overview

CVE-2026-43430 is a race condition vulnerability in the Linux kernel usb/yurex driver. The flaw exists in the probe routine where the bbu member of the device descriptor is not initialized before submitting a USB Request Block (URB). Because the URB's completion handler writes to bbu, a window exists during which probing logic can overwrite data that the completion handler has already retrieved. The Linux kernel maintainers have resolved the issue through a series of stable tree commits.

Critical Impact
A race condition in the yurex USB driver probe path can cause data corruption when a completion handler and probe routine concurrently access the bbu descriptor member.

Affected Products

Linux kernel usb/yurex driver (multiple stable branches)
Systems with the YUREX USB device driver compiled and loaded
Distributions tracking the upstream Linux stable trees referenced in the fix commits

Discovery Timeline

2026-05-08 - CVE-2026-43430 published to the National Vulnerability Database (NVD)
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43430

Vulnerability Analysis

The vulnerability resides in the yurex USB device driver probe function. During device probing, the driver submits a URB whose completion handler writes the device's bbu (button counter) value into the device descriptor. The probe routine fails to first initialize bbu to the sentinel value representing an uninitialized state before submitting the URB.

This ordering defect creates a small but real race window. If the URB completion handler executes and stores a retrieved value into bbu, and the probe path subsequently writes the uninitialized sentinel into the same field, valid device data is overwritten. The result is an inconsistent driver state when the device is later accessed.

The issue is classified as a race condition with characteristics of an order violation and uninitialized memory use during initialization.

Root Cause

The root cause is incorrect initialization ordering in the probe path. The descriptor field that the URB completion handler populates must be set to its uninitialized sentinel before the URB is submitted, not after. Submitting the URB first allows the completion callback to run on another CPU and store valid data before the probe routine clobbers it.

Attack Vector

The vulnerability is triggered during USB device probing. Physical access to attach a YUREX USB device, or the act of binding the driver to a present device, is required. The flaw is not a remote attack vector. It can produce inconsistent driver state and potential data loss within the kernel driver, depending on scheduling and CPU timing. The full technical analysis is available in the Kernel Git Commit Fixes and related stable tree commits.

No public exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-43430

Indicators of Compromise

Unexpected or inconsistent values reported by the YUREX device through /dev/yurex* character device nodes immediately after device attach
Kernel log messages from the yurex driver showing anomalous initial counter readings following probe
Driver state inconsistencies that resolve only after device re-enumeration

Detection Strategies

Inventory hosts running kernel versions matching the affected stable branches referenced in the Kernel Git Commit Changes
Audit loaded kernel modules for yurex.ko on systems that interact with USB peripherals
Compare running kernel build identifiers against vendor patch advisories for the stable branches

Monitoring Recommendations

Monitor dmesg and journalctl -k output for yurex driver messages during USB attach events
Track kernel package update status across the fleet to confirm patched builds are deployed
Log USB device hotplug events through udev to correlate driver probes with any reported anomalies

How to Mitigate CVE-2026-43430

Immediate Actions Required

Apply the latest Linux stable kernel update from your distribution that incorporates the upstream fix commits
If the YUREX driver is not required, unload and blacklist the yurex module to remove exposure
Restrict physical access to systems where unknown USB devices could be attached

Patch Information

The fix is available in the Linux stable trees through the commits referenced in the NVD entry, including Kernel Git Commit Changes, Kernel Git Commit Updates, Kernel Git Commit Fixes, Kernel Git Commit Improvements, Kernel Git Commit Enhancements, Kernel Git Commit Patches, Kernel Git Commit Modifications, and Kernel Git Commit Revisions. The fix reorders the probe routine so that bbu is set to the uninitialized sentinel value before the URB is submitted.

Workarounds

Blacklist the yurex kernel module on systems that do not use the YUREX USB device
Enforce USB device control policies that prevent unauthorized peripherals from attaching
Disable automatic module loading for unused USB drivers through modprobe.d configuration

bash

# Blacklist the yurex driver until the kernel is patched
echo "blacklist yurex" | sudo tee /etc/modprobe.d/blacklist-yurex.conf
sudo rmmod yurex 2>/dev/null || true
sudo update-initramfs -u