{"id":"CVE-2026-43427","title":"usb: class: cdc-wdm: fix reordering issue in read code path","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: class: cdc-wdm: fix reordering issue in read code path\n\nQuoting the bug report:\n\nDue to compiler optimization or CPU out-of-order execution, the\ndesc->length updat…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < 638328ca9c17ae6511ad62198c57bae32ffa3c91","Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < 170e8daca24da6edb4be82ab01abf44e87af387b","Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < c8fa96ed021923dae147bcd9f9205b8df7b82360","Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < 4ee3062bf2c9a722afef429826e8607eaf3fc6a0","Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < 276aef0fd2b92f41b920ac891c72cadeee957934","Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < 67ed312124bb1b61858778ac0b985b48961c862a","Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < e3c874b05901dc519054b5107d16620e6d2b5fea","Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < 8df672bfe3ec2268c2636584202755898e547173","Linux 2.6.26"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:38:09.164948Z"},"published":"2026-05-08","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:42:53.217Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43427","references":[{"url":"https://git.kernel.org/stable/c/638328ca9c17ae6511ad62198c57bae32ffa3c91"},{"url":"https://git.kernel.org/stable/c/170e8daca24da6edb4be82ab01abf44e87af387b"},{"url":"https://git.kernel.org/stable/c/c8fa96ed021923dae147bcd9f9205b8df7b82360"},{"url":"https://git.kernel.org/stable/c/4ee3062bf2c9a722afef429826e8607eaf3fc6a0"},{"url":"https://git.kernel.org/stable/c/276aef0fd2b92f41b920ac891c72cadeee957934"},{"url":"https://git.kernel.org/stable/c/67ed312124bb1b61858778ac0b985b48961c862a"},{"url":"https://git.kernel.org/stable/c/e3c874b05901dc519054b5107d16620e6d2b5fea"},{"url":"https://git.kernel.org/stable/c/8df672bfe3ec2268c2636584202755898e547173"}],"tags":["cve.org"],"epss":0.00132,"epssPercentile":0.02817,"ingestedAt":"2026-11-06T15:54:03.919Z","slug":"CVE-2026-43427","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: class: cdc-wdm: fix reordering issue in read code path\n\nQuoting the bug report:\n\nDue to compiler optimization or CPU out-of-order execution, the\ndesc->length update can be reordered before the memmove. If this\nhappens, wdm_read() can see the new length and call copy_to_user() on\nuninitialized memory. This also violates LKMM data race rules [1].\n\nFix it by using WRITE_ONCE and memory barriers.\n\n## Affected\n\n- `Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < 638328ca9c17ae6511ad62198c57bae32ffa3c91`\n- `Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < 170e8daca24da6edb4be82ab01abf44e87af387b`\n- `Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < c8fa96ed021923dae147bcd9f9205b8df7b82360`\n- `Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < 4ee3062bf2c9a722afef429826e8607eaf3fc6a0`\n- `Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < 276aef0fd2b92f41b920ac891c72cadeee957934`\n- `Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < 67ed312124bb1b61858778ac0b985b48961c862a`\n- `Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < e3c874b05901dc519054b5107d16620e6d2b5fea`\n- `Linux >= afba937e540c902c989cd516fd97ea0c8499bb27 < 8df672bfe3ec2268c2636584202755898e547173`\n- `Linux 2.6.26`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}