CVE-2026-43430

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: yurex: fix race in probe

The bbu member of the descriptor must be set to the value standing for uninitialized values before the URB whose completion handler sets bbu is submitted. Otherwise there is a window during which probing can overwrite already retrieved data.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
May 8, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-434315.5In the Linux kernel, the following vulnerability has been resolved: xhci: Fix NULL pointer dereference when reading portli debugfs files MCVE-2026-434325.5In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix memory leak in xhci_disable_slot() xhci_alloc_command()CVE-2026-434337.8In the Linux kernel, the following vulnerability has been resolved: rust_binder: avoid reading the written value in offsets array When senCVE-2026-434347.8In the Linux kernel, the following vulnerability has been resolved: rust_binder: check ownership before using vma When installing missing CVE-2026-434355.5In the Linux kernel, the following vulnerability has been resolved: rust_binder: fix oneway spam detection The spam detection logic in TreCVE-2026-434365.5In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer inteCVE-2026-434377.8In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drainCVE-2026-434387.8In the Linux kernel, the following vulnerability has been resolved: sched_ext: Remove redundant css_put() in scx_cgroup_init() The iteratoCVE-2026-434394.7In the Linux kernel, the following vulnerability has been resolved: cgroup: fix race between task migration and iteration When a task is mCVE-2026-43447.1A maliciously crafted HTML payload in a component name, when displayed during the delete confirmation dialog and clicked by a user, can trigCVE-2026-434407.8In the Linux kernel, the following vulnerability has been resolved: net/mana: Null service_wq on setup error to prevent double destroy In CVE-2026-434417.5In the Linux kernel, the following vulnerability has been resolved: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled When b