CVE-2026-43424

Vulnerability

Description

The Linux kernel's USB gadget f_tcm (Target Core Module) driver contained a NULL pointer dereference vulnerability in the Bulk-Only Transport (BOT) command handling functions. The tpg->tpg_nexus pointer, dynamically managed and tied to userspace configuration via ConfigFS, could be NULL if the USB host sent requests are sent before the nexus is fully established or after it is dropped. Functions like bot_submit_command() retrieved tv_nexus = tpg->tpg_nexus and immediately dereferenced tv_nexus->tvn_se_sess without any validation [1].

Exploitation

Prerequisites

A malicious or misconfigured USB host could exploit this race window by sending BOT commands during the time when the nexus is being set up or torn down. No authentication is required beyond USB connectivity, making this a local denial-of-service vector accessible to an attacker with physical USB access or a compromised host device [1].

Impact

Successful exploitation triggers a NULL pointer dereference, causing a kernel panic (local denial of service). The inconsistent API usage is evident because peer functions like usbg_submit_command() and bot_send_bad_response() correctly implemented NULL checks for tv_nexus before proceeding [1].

Mitigation

The fix introduces the missing if (!tv_nexus) checks into the vulnerable BOT command and request processing paths, aborting the command gracefully with an error instead of crashing. The patch is committed to the Linux kernel stable tree [1].