{
  "cveId": "CVE-2026-43424",
  "url": "https://patchblox.com/security/cve/CVE-2026-43424",
  "summary": "CVE-2026-43424 is fixed in 14 products on 1 platform, first by DEBIAN-CVE-2026-43424, released May 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: f_tcm: Fix NULL pointer dereference...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling  The \u0060tpg-\u003Etpg_nexus\u0060 pointer in the USB Target driver is dynamically managed and tied to userspace configuration via ConfigFS. It can be NULL if the USB host sends requests before the nexus is fully established or immediately after it is dropped.  Currently, functions like \u0060bot_submit_command()\u0060 and the data transfer paths retrieve \u0060tv_nexus = tpg-\u003Etpg_nexus\u0060 and immediately dereference \u0060tv_nexus-\u003Etvn_se_sess\u0060 without any validation. If a malicious or misconfigured USB host sends a BOT (Bulk-Only Transport) command during this race window, it triggers a NULL pointer dereference, leading to a kernel panic (local DoS).  This exposes an inconsistent API usage within the module, as peer functions like \u0060usbg_submit_command()\u0060 and \u0060bot_send_bad_response()\u0060 correctly implement a NULL check for \u0060tv_nexus\u0060 before proceeding.  Fix this by bringing consistency to the nexus handling. Add the missing \u0060if (!tv_nexus)\u0060 checks to the vulnerable BOT command and request processing paths, aborting the command gracefully with an error instead of crashing the system.",
  "published": "2026-05-08T15:16:54Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00123,
  "epssPercentile": 0.02031,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "dtb-aarch64",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-64kb",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-64kb",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-azure",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-azure",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23237-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23237-1",
      "released": "2026-08-11T21:34:22Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default-base",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1.160000.2.19",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default-base",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1.160000.2.19",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-docs",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-docs",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-kvmsmall",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-kvmsmall",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-build",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-qa",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-qa",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-rt",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.170-1",
      "fix": "DEBIAN-CVE-2026-43424",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-43424",
      "released": "2026-05-15T16:01:09Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.85-1",
      "fix": "DEBIAN-CVE-2026-43424",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-43424",
      "released": "2026-05-15T16:01:09Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.19.10-1",
      "fix": "DEBIAN-CVE-2026-43424",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-43424",
      "released": "2026-05-15T16:01:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}