CVE-2026-43343

usb: gadget: f_subset: Fix unbalanced refcnt in geth_free

State: Published
Severity: Not scored
Published: May 8, 2026
Updated: May 11, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_subset: Fix unbalanced refcnt in geth_free

geth_alloc() increments the reference count, but geth_free() fails to decrement it. This prevents the configuration of attributes via configfs after unlinking the function.

Decrement the reference count in geth_free() to ensure proper cleanup.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	02832e56f88a981474ee4c7c141f46fc1b4454f4 to before a932b171554714b1bca313b853c7aa9f2930f9aaAffected 02832e56f88a981474ee4c7c141f46fc1b4454f4 to before d7d702407b61e96286a15b6e715572f541a8d41cAffected 02832e56f88a981474ee4c7c141f46fc1b4454f4 to before 3f5bfc550a40d7493b1cf09540ed6b412b3b82beAffected 02832e56f88a981474ee4c7c141f46fc1b4454f4 to before 75776a055b656873319c3830fed471daef3ceb23Affected 02832e56f88a981474ee4c7c141f46fc1b4454f4 to before cc8ec610cd14c093a19371691a7ce1ee5421e829Affected 02832e56f88a981474ee4c7c141f46fc1b4454f4 to before 3d436670b47415da042452618fb5d8e317ab095fAffected 02832e56f88a981474ee4c7c141f46fc1b4454f4 to before 23e4851ce348a329d974e84e828155dda9f52122Affected 02832e56f88a981474ee4c7c141f46fc1b4454f4 to before caa27923aacd8a5869207842f2ab1657c6c0c7bcAffected
LinuxLinux	3.11Affected before 3.11Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.134 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

02832e56f88a981474ee4c7c141f46fc1b4454f4 to before a932b171554714b1bca313b853c7aa9f2930f9aaAffected
02832e56f88a981474ee4c7c141f46fc1b4454f4 to before d7d702407b61e96286a15b6e715572f541a8d41cAffected
02832e56f88a981474ee4c7c141f46fc1b4454f4 to before 3f5bfc550a40d7493b1cf09540ed6b412b3b82beAffected
02832e56f88a981474ee4c7c141f46fc1b4454f4 to before 75776a055b656873319c3830fed471daef3ceb23Affected
02832e56f88a981474ee4c7c141f46fc1b4454f4 to before cc8ec610cd14c093a19371691a7ce1ee5421e829Affected
02832e56f88a981474ee4c7c141f46fc1b4454f4 to before 3d436670b47415da042452618fb5d8e317ab095fAffected
02832e56f88a981474ee4c7c141f46fc1b4454f4 to before 23e4851ce348a329d974e84e828155dda9f52122Affected
02832e56f88a981474ee4c7c141f46fc1b4454f4 to before caa27923aacd8a5869207842f2ab1657c6c0c7bcAffected

LinuxLinux

3.11Affected
before 3.11Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.134 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.