CVE-2026-43424
NULL Pointer Dereference in Linux Kernel USB Target Driver
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's USB Target driver, specifically in the f_tcm module. The issue arises because the pointer tpg->tpg_nexus, which is dynamically managed and linked to userspace configuration, can be NULL during certain timing windows when the USB host sends requests before the nexus is fully established or just after it is dropped.
Some functions, like bot_submit_command() and data transfer paths, dereference this pointer without checking if it is NULL. If a malicious or misconfigured USB host sends a Bulk-Only Transport (BOT) command during this race condition, it causes a NULL pointer dereference, which leads to a kernel panic and a local denial of service (DoS).
The vulnerability is due to inconsistent API usage, as other functions correctly check for NULL before dereferencing. The fix involves adding the missing NULL checks to prevent the system from crashing by aborting commands gracefully with an error.
How can this vulnerability impact me? :
This vulnerability can lead to a local denial of service (DoS) on affected Linux systems. If a malicious or misconfigured USB host sends specially timed Bulk-Only Transport commands, it can trigger a kernel panic by causing a NULL pointer dereference.
The impact is that the system may crash unexpectedly, potentially causing service interruptions or requiring a reboot, which could affect availability and reliability.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by a NULL pointer dereference in the USB Target driver when handling BOT commands, leading to a kernel panic (local DoS).
Immediate mitigation involves updating the Linux kernel to a version where this issue is fixed by adding proper NULL checks for the nexus pointer in the affected functions.
Until an update is applied, avoid connecting potentially malicious or misconfigured USB hosts that might send BOT commands during the vulnerable race window.