CVE-2026-43427

Vulnerability: cdc-wdm Read Reordering

The Linux kernel's cdc-wdm driver contains a data race in the read code path. The desc->length update and the subsequent memmove are not properly ordered, meaning a compiler optimization or CPU out-of-order execution can cause desc->length to be stored before the data is moved. This violates the Linux Kernel Memory Model (LKMM) rules on data races [1].

Exploitation

An attacker who can interact with the device (e.g., via USB) may exploit this race condition. The wdm_read() function could observe the new desc->length value and call copy_to_user() on memory that has not yet been initialized with the new data, leading to exposure of kernel memory contents. No special privileges are required beyond access to the device file.

Impact

Successful exploitation could result in information disclosure, leaking sensitive kernel memory to an unprivileged user. The severity is dependent on the content of the leaked memory, but it undermines the confidentiality guarantees of the kernel.

Mitigation

The fix was applied in mainline and backported to stable kernels using WRITE_ONCE and explicit memory barriers to ensure correct ordering [2][3][4]. Users should update their kernel to include these patches.