CVE-2026-43324

{"id": "CVE-2026-43324", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "lessThan": "d847f375b1bcea713143bc02720d13d2d01b012a", "versionType": "git"}, {"status": "affected", "version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "lessThan": "cbf7df5e5d27cd5bea92ee9a75a4b28dbcc718d4", "versionType": "git"}, {"status": "affected", "version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "lessThan": "5aa776c8615bea3b1eaeec87b0788375800ead4f", "versionType": "git"}, {"status": "affected", "version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "lessThan": "94d4fab1dd9e64f45449bcc7d6a5acf796b13015", "versionType": "git"}, {"status": "affected", "version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "lessThan": "5687a09776069bd915560021c9728ca528440128", "versionType": "git"}, {"status": "affected", "version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "lessThan": "8bcd80219d8e10e660bf29b20e41bb8beb4e4cb7", "versionType": "git"}, {"status": "affected", "version": "04145a03db9d78469e0817ab3a767c76c0fb0947", "lessThan": "2ca9e46f8f1f5a297eb0ac83f79d35d5b3a02541", "versionType": "git"}], "programFiles": ["drivers/usb/gadget/udc/dummy_hcd.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"status": "unaffected", "version": "0", "lessThan": "5.14", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.168", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.134", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.81", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.22", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.12", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/usb/gadget/udc/dummy_hcd.c"], "defaultStatus": "affected"}]}], "published": "2026-05-08T14:16:41.060", "references": [{"url": "https://git.kernel.org/stable/c/2ca9e46f8f1f5a297eb0ac83f79d35d5b3a02541", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5687a09776069bd915560021c9728ca528440128", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5aa776c8615bea3b1eaeec87b0788375800ead4f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8bcd80219d8e10e660bf29b20e41bb8beb4e4cb7", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/94d4fab1dd9e64f45449bcc7d6a5acf796b13015", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cbf7df5e5d27cd5bea92ee9a75a4b28dbcc718d4", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d847f375b1bcea713143bc02720d13d2d01b012a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: dummy-hcd: Fix interrupt synchronization error\n\nThis fixes an error in synchronization in the dummy-hcd driver. The\nerror has a somewhat involved history. The synchronization mechanism\nwas introduced by commit 7dbd8f4cabd9 (\"USB: dummy-hcd: Fix erroneous\nsynchronization change\"), which added an emulated \"interrupts enabled\"\nflag together with code emulating synchronize_irq() (it waits until\nall current handler callbacks have returned).\n\nBut the emulated interrupt-disable occurred too late, after the driver\ncontaining the handler callback routines had been told that it was\nunbound and no more callbacks would occur. Commit 4a5d797a9f9c (\"usb:\ngadget: dummy_hcd: fix gpf in gadget_setup\") tried to fix this by\nmoving the synchronize_irq() emulation code from dummy_stop() to\ndummy_pullup(), which runs before the unbind callback.\n\nThere still were races, though, because the emulated interrupt-disable\nstill occurred too late. It couldn't be moved to dummy_pullup(),\nbecause that routine can be called for reasons other than an impending\nunbind. Therefore commits 7dc0c55e9f30 (\"USB: UDC core: Add\nudc_async_callbacks gadget op\") and 04145a03db9d (\"USB: UDC: Implement\nudc_async_callbacks in dummy-hcd\") added an API allowing the UDC core\nto tell dummy-hcd exactly when emulated interrupts and their callbacks\nshould be disabled.\n\nThat brings us to the current state of things, which is still wrong\nbecause the emulated synchronize_irq() occurs before the emulated\ninterrupt-disable! That's no good, beause it means that more emulated\ninterrupts can occur after the synchronize_irq() emulation has run,\nleading to the possibility that a callback handler may be running when\nthe gadget driver is unbound.\n\nTo fix this, we have to move the synchronize_irq() emulation code yet\nagain, to the dummy_udc_async_callbacks() routine, which takes care of\nenabling and disabling emulated interrupt requests. The\nsynchronization will now run immediately after emulated interrupts are\ndisabled, which is where it belongs."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nUSB: dummy-hcd: Correcci\u00f3n de error de sincronizaci\u00f3n de interrupciones\n\nEsto corrige un error de sincronizaci\u00f3n en el controlador dummy-hcd. El error tiene una historia un tanto intrincada. El mecanismo de sincronizaci\u00f3n fue introducido por el commit 7dbd8f4cabd9 (\u2019USB: dummy-hcd: Correcci\u00f3n de cambio de sincronizaci\u00f3n err\u00f3neo\u2019), que a\u00f1adi\u00f3 una bandera emulada de \u2019interrupciones habilitadas\u2019 junto con c\u00f3digo que emula synchronize_irq() (espera hasta que todas las devoluciones de llamada del gestor actuales hayan regresado).\n\nPero la deshabilitaci\u00f3n de interrupciones emulada ocurri\u00f3 demasiado tarde, despu\u00e9s de que al controlador que conten\u00eda las rutinas de devoluci\u00f3n de llamada del gestor se le hab\u00eda informado que estaba desvinculado y que no ocurrir\u00edan m\u00e1s devoluciones de llamada. El commit 4a5d797a9f9c (\u2019usb: gadget: dummy_hcd: correcci\u00f3n de gpf en gadget_setup\u2019) intent\u00f3 corregir esto moviendo el c\u00f3digo de emulaci\u00f3n de synchronize_irq() de dummy_stop() a dummy_pullup(), que se ejecuta antes de la devoluci\u00f3n de llamada de desvinculaci\u00f3n.\n\nSin embargo, a\u00fan hab\u00eda condiciones de carrera, porque la deshabilitaci\u00f3n de interrupciones emulada todav\u00eda ocurr\u00eda demasiado tarde. No pod\u00eda moverse a dummy_pullup(), porque esa rutina puede ser llamada por razones distintas a una desvinculaci\u00f3n inminente. Por lo tanto, los commits 7dc0c55e9f30 (\u2019USB: UDC core: A\u00f1adir operaci\u00f3n de gadget udc_async_callbacks\u2019) y 04145a03db9d (\u2019USB: UDC: Implementar udc_async_callbacks en dummy-hcd\u2019) a\u00f1adieron una API permitiendo al n\u00facleo UDC indicar a dummy-hcd exactamente cu\u00e1ndo las interrupciones emuladas y sus devoluciones de llamada deben ser deshabilitadas.\n\nEso nos lleva al estado actual de las cosas, que sigue siendo incorrecto porque el synchronize_irq() emulado ocurre antes de la deshabilitaci\u00f3n de interrupciones emulada. Eso no es bueno, porque significa que pueden ocurrir m\u00e1s interrupciones emuladas despu\u00e9s de que la emulaci\u00f3n de synchronize_irq() se haya ejecutado, lo que lleva a la posibilidad de que un gestor de devoluci\u00f3n de llamada est\u00e9 ejecut\u00e1ndose cuando el controlador del gadget est\u00e1 desvinculado.\n\nPara corregir esto, tenemos que mover el c\u00f3digo de emulaci\u00f3n de synchronize_irq() una vez m\u00e1s, a la rutina dummy_udc_async_callbacks(), que se encarga de habilitar y deshabilitar las solicitudes de interrupci\u00f3n emuladas. La sincronizaci\u00f3n ahora se ejecutar\u00e1 inmediatamente despu\u00e9s de que las interrupciones emuladas sean deshabilitadas, que es donde debe estar."}], "lastModified": "2026-11-11T20:10:00.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6A985A0-96A3-4E0A-B271-C7200F325EF1", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B", "versionEndExcluding": "6.1.168", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F56F925B-BAF8-4F4B-B62F-1496AF19A307", "versionEndExcluding": "6.6.134", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC", "versionEndExcluding": "6.12.81", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}