GHSA-MVVM-H9GX-GVQM

Vulnerability from github – Published: 2026-05-08 15:31 – Updated: 2026-05-20 21:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

usb: image: mdc800: kill download URB on timeout

mdc800_device_read() submits download_urb and waits for completion. If the timeout fires and the device has not responded, the function returns without killing the URB, leaving it active.

A subsequent read() resubmits the same URB while it is still in-flight, triggering the WARN in usb_submit_urb():

"URB submitted while active"

Check the return value of wait_event_timeout() and kill the URB if it indicates timeout, ensuring the URB is complete before its status is inspected or the URB is resubmitted.

Similar to - commit 372c93131998 ("USB: yurex: fix control-URB timeout handling") - commit b98d5000c505 ("media: rc: iguanair: handle timeouts")

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-43425"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-08T15:16:54Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: image: mdc800: kill download URB on timeout\n\nmdc800_device_read() submits download_urb and waits for completion.\nIf the timeout fires and the device has not responded, the function\nreturns without killing the URB, leaving it active.\n\nA subsequent read() resubmits the same URB while it is still\nin-flight, triggering the WARN in usb_submit_urb():\n\n  \"URB submitted while active\"\n\nCheck the return value of wait_event_timeout() and kill the URB if\nit indicates timeout, ensuring the URB is complete before its status\nis inspected or the URB is resubmitted.\n\nSimilar to\n- commit 372c93131998 (\"USB: yurex: fix control-URB timeout handling\")\n- commit b98d5000c505 (\"media: rc: iguanair: handle timeouts\")",
  "id": "GHSA-mvvm-h9gx-gvqm",
  "modified": "2026-05-20T21:31:28Z",
  "published": "2026-05-08T15:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43425"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/15536f6c15f48037a1672cbdea53266d67861ff6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/155f471e38aa516f6c58c2ae03ca3dc222fa2fdb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1be3b77de4eb89af8ae2fd6610546be778e25589"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9bf877cc67309b2a063b0087c3ad8585fb11cec3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9fa5a49760979ba016506fe292a431c8b83f043e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b7fed917f84e484e06c5e9926746d0b524e3a93e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cc7398447810c9450c90d092efe9997569f8d96f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d4a400a6a4c4d49f77a04a3f401df5ae1a10657c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.