CVE-2026-43425
USB URB Timeout Handling Flaw in Linux Kernel
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's handling of USB image devices, specifically the mdc800 driver. The function mdc800_device_read() submits a USB Request Block (URB) called download_urb and waits for its completion. If the device does not respond within a timeout period, the function returns without properly killing the URB, leaving it active.
When a subsequent read() operation occurs, it resubmits the same URB while it is still active, which triggers a warning in the kernel: "URB submitted while active." This improper handling can cause unexpected behavior or instability in the USB subsystem.
The fix involves checking the return value of the wait_event_timeout() function and killing the URB if a timeout occurs, ensuring the URB is complete before its status is inspected or resubmitted.
How can this vulnerability impact me? :
This vulnerability can lead to instability or unexpected warnings in the Linux kernel's USB subsystem when using affected devices. Specifically, it may cause the kernel to attempt to resubmit an already active URB, which can result in kernel warnings or potential malfunction of USB image devices using the mdc800 driver.
While the description does not explicitly mention security breaches such as privilege escalation or data corruption, the improper handling of URBs could potentially lead to system instability or denial of service conditions related to USB device operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a warning message triggered by the USB subsystem in the Linux kernel when a URB (USB Request Block) is submitted while it is still active. Detection involves monitoring system logs for the specific warning message.
- Check kernel logs for the warning: "URB submitted while active"
- Use the command: dmesg | grep 'URB submitted while active'
- Alternatively, monitor /var/log/kern.log or /var/log/messages for the warning.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved by ensuring that the download URB is killed on timeout before it is resubmitted. Immediate mitigation involves updating the Linux kernel to a version that includes the fix for this issue.
- Update the Linux kernel to a version that includes the patch fixing the mdc800 USB timeout handling.
- Avoid using affected USB devices or drivers until the patch is applied.