{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-43327",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-43327"
  ],
  "published": "2026-05-08T13:31:29Z",
  "summary": "USB: dummy-hcd: Fix locking/synchronization error",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: dummy-hcd: Fix locking/synchronization error\n\nSyzbot testing was able to provoke an addressing exception and crash\nin the usb_gadget_udc_reset() routine in\ndrivers/usb/gadgets/udc/core.c, resulting from the fact that the\nroutine was called with a second (\"driver\") argument of NULL.  The bad\ncaller was set_link_state() in dummy_hcd.c, and the problem arose\nbecause of a race between a USB reset and driver unbind.\n\nThese sorts of races were not supposed to be possible; commit\n7dbd8f4cabd9 (\"USB: dummy-hcd: Fix erroneous synchronization change\"),\nalong with a few followup commits, was written specifically to prevent\nthem.  As it turns out, there are (at least) two errors remaining in\nthe code.  Another patch will address the second error; this one is\nconcerned with the first.\n\nThe error responsible for the syzbot crash occurred because the\nstop_activity() routine will sometimes drop and then re-acquire the\ndum->lock spinlock.  A call to stop_activity() occurs in\nset_link_state() when handling an emulated USB reset, after the test\nof dum->ints_enabled and before the increment of dum->callback_usage.\nThis allowed another thread (doing a driver unbind) to sneak in and\ngrab the spinlock, and then clear dum->ints_enabled and dum->driver.\nNormally this other thread would have to wait for dum->callback_usage\nto go down to 0 before it would clear dum->driver, but in this case it\ndidn't have to wait since dum->callback_usage had not yet been\nincremented.\n\nThe fix is to increment dum->callback_usage _before_ calling\nstop_activity() instead of after.  Then the thread doing the unbind\nwill not clear dum->driver until after the call to\nusb_gadget_udc_reset() safely returns and dum->callback_usage has been\ndecremented again.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.168",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43327"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6350c7dd33ab481ef41c931a238361490c32d15c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cc97fb5969177cccce2e23b31298df220fc7570d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/218886b2ef2dea7627d3700ab0abaf4bf9d1161f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/791966f85b439b261bf19865cf1c07c065ffb4b4"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/805b1833d6ed6da5086e610578a28e71bb54fbbb"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/efbd9441f1e769a7aae1813d497cec09cbdff031"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/69ab97a693251d6a6093e630060a3c744fd58524"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/616a63ff495df12863692ab3f9f7b84e3fa7a66d"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-05-24T06:48:58Z"
  }
}