{"id":"CVE-2026-43170","title":"usb: dwc3: gadget: Move vbus draw to workqueue context","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Move vbus draw to workqueue context\n\nCurrently dwc3_gadget_vbus_draw() can be called from atomic\ncontext, which in turn invokes power-supply-core API…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < b214f0b11a0f1186f83c284f6a545110f76066b6","Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < 76c1123ffccfaba95cf4ecc2a50f95504a522424","Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < a7a80c25b65112768eeba58a7af129d3c52a6d90","Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < 2333653ef854c2cc124077f71a8526f03bf6e06a","Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < 74a231e3d99d310497ab0ccb359539a6063b316a","Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < 54aaa3b387c2f580a99dc86a9cc2eb6dfaf599a7","Linux 5.13"],"published":"2026-05-06","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:25:07.027Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43170","references":[{"url":"https://git.kernel.org/stable/c/b214f0b11a0f1186f83c284f6a545110f76066b6"},{"url":"https://git.kernel.org/stable/c/76c1123ffccfaba95cf4ecc2a50f95504a522424"},{"url":"https://git.kernel.org/stable/c/a7a80c25b65112768eeba58a7af129d3c52a6d90"},{"url":"https://git.kernel.org/stable/c/2333653ef854c2cc124077f71a8526f03bf6e06a"},{"url":"https://git.kernel.org/stable/c/74a231e3d99d310497ab0ccb359539a6063b316a"},{"url":"https://git.kernel.org/stable/c/54aaa3b387c2f580a99dc86a9cc2eb6dfaf599a7"}],"tags":["cve.org"],"epss":0.00125,"epssPercentile":0.02225,"ingestedAt":"2026-11-05T15:02:32.270Z","slug":"CVE-2026-43170","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Move vbus draw to workqueue context\n\nCurrently dwc3_gadget_vbus_draw() can be called from atomic\ncontext, which in turn invokes power-supply-core APIs. And\nsome these PMIC APIs have operations that may sleep, leading\nto kernel panic.\n\nFix this by moving the vbus_draw into a workqueue context.\n\n## Affected\n\n- `Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < b214f0b11a0f1186f83c284f6a545110f76066b6`\n- `Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < 76c1123ffccfaba95cf4ecc2a50f95504a522424`\n- `Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < a7a80c25b65112768eeba58a7af129d3c52a6d90`\n- `Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < 2333653ef854c2cc124077f71a8526f03bf6e06a`\n- `Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < 74a231e3d99d310497ab0ccb359539a6063b316a`\n- `Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < 54aaa3b387c2f580a99dc86a9cc2eb6dfaf599a7`\n- `Linux 5.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}