CVE-2026-43342

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_rndis: Protect RNDIS options with mutex

The class/subclass/protocol options are suspectible to race conditions as they can be accessed concurrently through configfs.

Use existing mutex to protect these options. This issue was identified during code inspection.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-362

Affected software

VendorProductVersions
LinuxLinux>= 73517cf49bd449122b615d2b7a6bb835f02252e5, < 0a75d97c53477a59c0aa1c65f69038c719f9c5b8; >= 73517cf49bd449122b615d2b7a6bb835f02252e5, < c1b3d5b0acb194efe20fc5864ee03439fa7bd45c; >= 73517cf49bd449122b615d2b7a6bb835f02252e5, < 65b7dbf80a1627667c241fff7c1c224f3118014f; >= 73517cf49bd449122b615d2b7a6bb835f02252e5, < cb5316b37288ab8791584e32f114c4f41ad45b67; >= 73517cf49bd449122b615d2b7a6bb835f02252e5, < 7d8fa3b8783ab95a46e20d97fbeeede719b2efda; >= 73517cf49bd449122b615d2b7a6bb835f02252e5, < 446f1842cda929c40d4697722bfdcfb334bc9692; >= 73517cf49bd449122b615d2b7a6bb835f02252e5, < 209decd3f7901df9842b83f2540dc8685e344a07; >= 73517cf49bd449122b615d2b7a6bb835f02252e5, < 8d8c68b1fc06ece60cf43e1306ff0f4ac121547e
LinuxLinux4.14

References

Timeline

Published
May 8, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-433435.5In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_subset: Fix unbalanced refcnt in geth_free geth_alloc()CVE-2026-433445.5In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix die ID init and look up bugs In snbep_pci2pCVE-2026-433457.5In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix event ring index not programmed for IPA v5.0+ For IPA v5CVE-2026-433465.5In the Linux kernel, the following vulnerability has been resolved: ice: ptp: don't WARN when controlling PF is unavailable In VFIO passthCVE-2026-433477.5In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region We obserCVE-2026-433485.5In the Linux kernel, the following vulnerability has been resolved: mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER When registeringCVE-2026-433495.5In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footerCVE-2026-43355.4The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attachment post_title in all versioCVE-2026-433507.6In the Linux kernel, the following vulnerability has been resolved: smb: client: require a full NFS mode SID before reading mode bits parsCVE-2026-433515.5In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Eagerly init vgic dist/redist on vgic creation If vgic_allCVE-2026-433527.8In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue TheCVE-2026-433537.8In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue The HCI DMA dequeue pa