Medium 5.5Published May 8, 2026

CVE-2026-43424usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling

Updated under an hour ago (Oct 27, 2026, 9:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling The `tpg->tpg_nexus` pointer in the USB Target driver is dynamically managed and tied to userspace configuration via ConfigFS. It can be NULL if the USB host sends requests before the nexus is fully established or immediately after it is dropped. Currently, functions like `bot_submit_command()` and the data transfer paths retrieve `tv_nexus = tpg->tpg_nexus` and immediately dereference `tv_nexus->tvn_se_sess` without any validation. If a malicious or misconfigured USB host sends a BOT (Bulk-Only Transport) command during this race window, it triggers a NULL pointer dereference, leading to a kernel panic (local DoS). This exposes an inconsistent API usage within the module, as peer functions like `usbg_submit_command()` and `bot_send_bad_response()` correctly implement a NULL check for `tv_nexus` before proceeding. Fix this by bringing consistency to the nexus handling. Add the missing `if (!tv_nexus)` checks to the vulnerable BOT command and request processing paths, aborting the command gracefully with an error instead of crashing the system.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c52661d60f636d17e26ad834457db333bd1df494 before b9b26d7f3aa288cfa54a7bc68612bab1f153f156; from c52661d60f636d17e26ad834457db333bd1df494 before 2a2ef846a54a06c33b5c2d4b0d918583e1e7c0b7; from c52661d60f636d17e26ad834457db333bd1df494 before d146f27758049fa55ae4c53785a852d3cf7a18d6; from c52661d60f636d17e26ad834457db333bd1df494 before f962ca3b020e13d6714f27e8c36fe742441c58d1; from c52661d60f636d17e26ad834457db333bd1df494 before 679d9535aeb15c10bce89c44102004b96624d706; from c52661d60f636d17e26ad834457db333bd1df494 before 3d309b37633c4a847fc149939a2c9576f1aa1065; from c52661d60f636d17e26ad834457db333bd1df494 before b9fde507355342a2d64225d582dc8b98ff5ecb19	CNA record
linux linux_kernel linux:linux_kernel	from 3.5 before 5.10.253; from 5.11 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.19; from 6.19 before 6.19.9; 7.0; 7.0; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/b9b26d7f3aa288cfa54a7bc68612bab1f153f156	patch
https://git.kernel.org/stable/c/2a2ef846a54a06c33b5c2d4b0d918583e1e7c0b7	patch
https://git.kernel.org/stable/c/d146f27758049fa55ae4c53785a852d3cf7a18d6	patch
https://git.kernel.org/stable/c/f962ca3b020e13d6714f27e8c36fe742441c58d1	patch
https://git.kernel.org/stable/c/679d9535aeb15c10bce89c44102004b96624d706	patch
https://git.kernel.org/stable/c/3d309b37633c4a847fc149939a2c9576f1aa1065	patch
https://git.kernel.org/stable/c/b9fde507355342a2d64225d582dc8b98ff5ecb19	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.