CVE-2026-43427

usb: class: cdc-wdm: fix reordering issue in read code path

State: Published
Severity: Not scored
Published: May 8, 2026
Updated: May 11, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: class: cdc-wdm: fix reordering issue in read code path

Quoting the bug report:

Due to compiler optimization or CPU out-of-order execution, the desc->length update can be reordered before the memmove. If this happens, wdm_read() can see the new length and call copy_to_user() on uninitialized memory. This also violates LKMM data race rules [1].

Fix it by using WRITE_ONCE and memory barriers.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	afba937e540c902c989cd516fd97ea0c8499bb27 to before 638328ca9c17ae6511ad62198c57bae32ffa3c91Affected afba937e540c902c989cd516fd97ea0c8499bb27 to before 170e8daca24da6edb4be82ab01abf44e87af387bAffected afba937e540c902c989cd516fd97ea0c8499bb27 to before c8fa96ed021923dae147bcd9f9205b8df7b82360Affected afba937e540c902c989cd516fd97ea0c8499bb27 to before 4ee3062bf2c9a722afef429826e8607eaf3fc6a0Affected afba937e540c902c989cd516fd97ea0c8499bb27 to before 276aef0fd2b92f41b920ac891c72cadeee957934Affected afba937e540c902c989cd516fd97ea0c8499bb27 to before 67ed312124bb1b61858778ac0b985b48961c862aAffected afba937e540c902c989cd516fd97ea0c8499bb27 to before e3c874b05901dc519054b5107d16620e6d2b5feaAffected afba937e540c902c989cd516fd97ea0c8499bb27 to before 8df672bfe3ec2268c2636584202755898e547173Affected
LinuxLinux	2.6.26Affected before 2.6.26Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.78 through 6.12.Not affected 6.18.19 through 6.18.Not affected 6.19.9 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

afba937e540c902c989cd516fd97ea0c8499bb27 to before 638328ca9c17ae6511ad62198c57bae32ffa3c91Affected
afba937e540c902c989cd516fd97ea0c8499bb27 to before 170e8daca24da6edb4be82ab01abf44e87af387bAffected
afba937e540c902c989cd516fd97ea0c8499bb27 to before c8fa96ed021923dae147bcd9f9205b8df7b82360Affected
afba937e540c902c989cd516fd97ea0c8499bb27 to before 4ee3062bf2c9a722afef429826e8607eaf3fc6a0Affected
afba937e540c902c989cd516fd97ea0c8499bb27 to before 276aef0fd2b92f41b920ac891c72cadeee957934Affected
afba937e540c902c989cd516fd97ea0c8499bb27 to before 67ed312124bb1b61858778ac0b985b48961c862aAffected
afba937e540c902c989cd516fd97ea0c8499bb27 to before e3c874b05901dc519054b5107d16620e6d2b5feaAffected
afba937e540c902c989cd516fd97ea0c8499bb27 to before 8df672bfe3ec2268c2636584202755898e547173Affected

LinuxLinux

2.6.26Affected
before 2.6.26Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.78 through 6.12.*Not affected
6.18.19 through 6.18.*Not affected
6.19.9 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.