CVE-2026-43429: USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
In the Linux kernel, the following vulnerability has been resolved:
USB: usbtmc: Use usbbulkmsgkillable() with user-specified timeouts
The usbtmc driver accepts timeout values specified by the user in an ioctl command, and uses these timeouts for some usbbulkmsg() calls. Since the user can specify arbitrarily long timeouts and usbbulkmsg() uses unkillable waits, call usbbulkmsgkillable() instead to avoid the possibility of the user hanging a kernel thread indefinitely.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43429?
The severity of CVE-2026-43429 is medium with a score of 5.5 according to the CVSS 3.1 metrics.
How do I fix CVE-2026-43429?
To fix CVE-2026-43429, apply the available patches provided for the Linux kernel and the usbtmc driver.
What type of component is affected by CVE-2026-43429?
CVE-2026-43429 affects the usbtmc driver in the Linux kernel.
What are the potential impacts of CVE-2026-43429?
CVE-2026-43429 may allow a user to specify malicious timeouts that could lead to denial of service.
When was CVE-2026-43429 published?
CVE-2026-43429 was published on May 8, 2026.