CVE-2026-43425
Analyzed Analyzed - Analysis Complete
USB URB Timeout Handling Flaw in Linux Kernel

Publication date: 2026-05-08

Last updated on: 2026-05-20

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: image: mdc800: kill download URB on timeout mdc800_device_read() submits download_urb and waits for completion. If the timeout fires and the device has not responded, the function returns without killing the URB, leaving it active. A subsequent read() resubmits the same URB while it is still in-flight, triggering the WARN in usb_submit_urb(): "URB submitted while active" Check the return value of wait_event_timeout() and kill the URB if it indicates timeout, ensuring the URB is complete before its status is inspected or the URB is resubmitted. Similar to - commit 372c93131998 ("USB: yurex: fix control-URB timeout handling") - commit b98d5000c505 ("media: rc: iguanair: handle timeouts")
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-08
Last Modified
2026-05-20
Generated
2026-06-19
AI Q&A
2026-05-08
EPSS Evaluated
2026-06-18
NVD
CVE-2026-43425
EUVD
EUVD-2026-28731
Affected Vendors & Products
Showing 17 associated CPEs
Vendor Product Version / Range
linux linux_kernel 2.6.12
linux linux_kernel 2.6.12
linux linux_kernel 2.6.12
linux linux_kernel 2.6.12
linux linux_kernel 2.6.12
linux linux_kernel 2.6.12
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.2 (inc) to 6.6.130 (exc)
linux linux_kernel From 5.11 (inc) to 5.15.203 (exc)
linux linux_kernel From 5.16 (inc) to 6.1.167 (exc)
linux linux_kernel From 6.13 (inc) to 6.18.19 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.78 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.9 (exc)
linux linux_kernel From 2.6.12.1 (inc) to 5.10.253 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's handling of USB image devices, specifically the mdc800 driver. The function mdc800_device_read() submits a USB Request Block (URB) called download_urb and waits for its completion. If the device does not respond within a timeout period, the function returns without properly killing the URB, leaving it active.

When a subsequent read() operation occurs, it resubmits the same URB while it is still active, which triggers a warning in the kernel: "URB submitted while active." This improper handling can cause unexpected behavior or instability in the USB subsystem.

The fix involves checking the return value of the wait_event_timeout() function and killing the URB if a timeout occurs, ensuring the URB is complete before its status is inspected or resubmitted.

Impact Analysis

This vulnerability can lead to instability or unexpected warnings in the Linux kernel's USB subsystem when using affected devices. Specifically, it may cause the kernel to attempt to resubmit an already active URB, which can result in kernel warnings or potential malfunction of USB image devices using the mdc800 driver.

While the description does not explicitly mention security breaches such as privilege escalation or data corruption, the improper handling of URBs could potentially lead to system instability or denial of service conditions related to USB device operations.

Detection Guidance

This vulnerability manifests as a warning message triggered by the USB subsystem in the Linux kernel when a URB (USB Request Block) is submitted while it is still active. Detection involves monitoring system logs for the specific warning message.

  • Check kernel logs for the warning: "URB submitted while active"
  • Use the command: dmesg | grep 'URB submitted while active'
  • Alternatively, monitor /var/log/kern.log or /var/log/messages for the warning.
Mitigation Strategies

The vulnerability is resolved by ensuring that the download URB is killed on timeout before it is resubmitted. Immediate mitigation involves updating the Linux kernel to a version that includes the fix for this issue.

  • Update the Linux kernel to a version that includes the patch fixing the mdc800 USB timeout handling.
  • Avoid using affected USB devices or drivers until the patch is applied.
Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-43425. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart