CVE-2026-43427: usb: class: cdc-wdm: fix reordering issue in read code path
In the Linux kernel, the following vulnerability has been resolved:
usb: class: cdc-wdm: fix reordering issue in read code path
Quoting the bug report:
Due to compiler optimization or CPU out-of-order execution, the desc->length update can be reordered before the memmove. If this happens, wdmread() can see the new length and call copytouser() on uninitialized memory. This also violates LKMM data race rules [1].
Fix it by using WRITEONCE and memory barriers.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running the Linux kernel are affected where the cdc-wdm USB class driver's read path is in use. Exploitation requires local access and low privileges; no user interaction is required.
What does an attacker need to exploit it?
An attacker needs local, low-privileged access to trigger the affected read path. The vulnerability can cause uninitialized kernel memory to be copied to user space, resulting in high confidentiality impact, and can also cause high availability impact.
What should be done if patching is not immediately possible?
Apply an available patch for the Linux kernel. The provided remediation information does not identify a configuration workaround or mitigation for systems that cannot yet be patched.