CVE-2026-43424
NULL Pointer Dereference in Linux Kernel USB Target Driver
Publication date: 2026-05-08
Last updated on: 2026-05-20
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.2 (inc) to 6.6.130 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.19 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.78 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.9 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 6.1.167 (exc) |
| linux | linux_kernel | From 3.5 (inc) to 5.10.253 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's USB Target driver, specifically in the f_tcm module. The issue arises because the pointer tpg->tpg_nexus, which is dynamically managed and linked to userspace configuration, can be NULL during certain timing windows when the USB host sends requests before the nexus is fully established or just after it is dropped.
Some functions, like bot_submit_command() and data transfer paths, dereference this pointer without checking if it is NULL. If a malicious or misconfigured USB host sends a Bulk-Only Transport (BOT) command during this race condition, it causes a NULL pointer dereference, which leads to a kernel panic and a local denial of service (DoS).
The vulnerability is due to inconsistent API usage, as other functions correctly check for NULL before dereferencing. The fix involves adding the missing NULL checks to prevent the system from crashing by aborting commands gracefully with an error.
How can this vulnerability impact me? :
This vulnerability can lead to a local denial of service (DoS) on affected Linux systems. If a malicious or misconfigured USB host sends specially timed Bulk-Only Transport commands, it can trigger a kernel panic by causing a NULL pointer dereference.
The impact is that the system may crash unexpectedly, potentially causing service interruptions or requiring a reboot, which could affect availability and reliability.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by a NULL pointer dereference in the USB Target driver when handling BOT commands, leading to a kernel panic (local DoS).
Immediate mitigation involves updating the Linux kernel to a version where this issue is fixed by adding proper NULL checks for the nexus pointer in the affected functions.
Until an update is applied, avoid connecting potentially malicious or misconfigured USB hosts that might send BOT commands during the vulnerable race window.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a NULL pointer dereference in the USB Target driver of the Linux kernel when handling Bulk-Only Transport (BOT) commands from a USB host. Detection would involve monitoring for kernel panics or crashes related to USB gadget subsystem activity, especially when USB devices are connected or send commands.
Since the issue arises from a race condition triggered by specific USB BOT commands sent before the nexus is fully established, direct detection on the network or system via commands is not straightforward from the provided information.
No specific detection commands or network signatures are provided in the available context or resources.