CVE-2026-43170

Vulnerability

The Linux kernel's dwc3 USB gadget driver contains a bug in the dwc3_gadget_vbus_draw() function. This function can be invoked from atomic context, but it calls power-supply-core APIs that may perform sleeping operations. This mismatch leads to a kernel panic when the driver attempts to draw VBUS power from a PMIC that requires sleeping operations.

Exploitation

An attacker with local access to the system can trigger this vulnerability by causing the USB gadget driver to call dwc3_gadget_vbus_draw() from an atomic context. This could occur during USB state transitions or gadget configuration changes. No special privileges beyond local access are required, but the attacker must be able to interact with the USB gadget subsystem.

Impact

Successful exploitation results in a kernel panic, causing a denial of service (DoS) on the affected system. The system becomes unavailable until rebooted. The CVSS v3 score of 5.5 (Medium) reflects the local attack vector and availability impact.

Mitigation

The fix moves the vbus_draw operation into a workqueue context, ensuring that sleeping operations are not performed in atomic context. The patch has been applied to the Linux kernel stable tree [1][2][3][4]. Users should update to a kernel version containing this fix.