GHSA-RX37-Q58J-C4C7
Vulnerability from github – Published: 2026-05-08 15:31 – Updated: 2026-05-20 21:31In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
The tpg->tpg_nexus pointer in the USB Target driver is dynamically
managed and tied to userspace configuration via ConfigFS. It can be
NULL if the USB host sends requests before the nexus is fully
established or immediately after it is dropped.
Currently, functions like bot_submit_command() and the data
transfer paths retrieve tv_nexus = tpg->tpg_nexus and immediately
dereference tv_nexus->tvn_se_sess without any validation. If a
malicious or misconfigured USB host sends a BOT (Bulk-Only Transport)
command during this race window, it triggers a NULL pointer
dereference, leading to a kernel panic (local DoS).
This exposes an inconsistent API usage within the module, as peer
functions like usbg_submit_command() and bot_send_bad_response()
correctly implement a NULL check for tv_nexus before proceeding.
Fix this by bringing consistency to the nexus handling. Add the
missing if (!tv_nexus) checks to the vulnerable BOT command and
request processing paths, aborting the command gracefully with an
error instead of crashing the system.
{
"affected": [],
"aliases": [
"CVE-2026-43424"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-08T15:16:54Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling\n\nThe `tpg-\u003etpg_nexus` pointer in the USB Target driver is dynamically\nmanaged and tied to userspace configuration via ConfigFS. It can be\nNULL if the USB host sends requests before the nexus is fully\nestablished or immediately after it is dropped.\n\nCurrently, functions like `bot_submit_command()` and the data\ntransfer paths retrieve `tv_nexus = tpg-\u003etpg_nexus` and immediately\ndereference `tv_nexus-\u003etvn_se_sess` without any validation. If a\nmalicious or misconfigured USB host sends a BOT (Bulk-Only Transport)\ncommand during this race window, it triggers a NULL pointer\ndereference, leading to a kernel panic (local DoS).\n\nThis exposes an inconsistent API usage within the module, as peer\nfunctions like `usbg_submit_command()` and `bot_send_bad_response()`\ncorrectly implement a NULL check for `tv_nexus` before proceeding.\n\nFix this by bringing consistency to the nexus handling. Add the\nmissing `if (!tv_nexus)` checks to the vulnerable BOT command and\nrequest processing paths, aborting the command gracefully with an\nerror instead of crashing the system.",
"id": "GHSA-rx37-q58j-c4c7",
"modified": "2026-05-20T21:31:28Z",
"published": "2026-05-08T15:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43424"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2a2ef846a54a06c33b5c2d4b0d918583e1e7c0b7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3d309b37633c4a847fc149939a2c9576f1aa1065"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/679d9535aeb15c10bce89c44102004b96624d706"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b9b26d7f3aa288cfa54a7bc68612bab1f153f156"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b9fde507355342a2d64225d582dc8b98ff5ecb19"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d146f27758049fa55ae4c53785a852d3cf7a18d6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f962ca3b020e13d6714f27e8c36fe742441c58d1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.