---
id: CVE-2026-43170
title: 'usb: dwc3: gadget: Move vbus draw to workqueue context'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: dwc3: gadget: Move vbus draw to workqueue context

  Currently dwc3_gadget_vbus_draw() can be called from atomic
  context, which in turn invokes power-supply-core API…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f <
    b214f0b11a0f1186f83c284f6a545110f76066b6
  - >-
    Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f <
    76c1123ffccfaba95cf4ecc2a50f95504a522424
  - >-
    Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f <
    a7a80c25b65112768eeba58a7af129d3c52a6d90
  - >-
    Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f <
    2333653ef854c2cc124077f71a8526f03bf6e06a
  - >-
    Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f <
    74a231e3d99d310497ab0ccb359539a6063b316a
  - >-
    Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f <
    54aaa3b387c2f580a99dc86a9cc2eb6dfaf599a7
  - Linux 5.13
published: '2026-05-06'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:25:07.027Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43170'
references:
  - url: 'https://git.kernel.org/stable/c/b214f0b11a0f1186f83c284f6a545110f76066b6'
  - url: 'https://git.kernel.org/stable/c/76c1123ffccfaba95cf4ecc2a50f95504a522424'
  - url: 'https://git.kernel.org/stable/c/a7a80c25b65112768eeba58a7af129d3c52a6d90'
  - url: 'https://git.kernel.org/stable/c/2333653ef854c2cc124077f71a8526f03bf6e06a'
  - url: 'https://git.kernel.org/stable/c/74a231e3d99d310497ab0ccb359539a6063b316a'
  - url: 'https://git.kernel.org/stable/c/54aaa3b387c2f580a99dc86a9cc2eb6dfaf599a7'
tags:
  - cve.org
epss: 0.00125
epssPercentile: 0.02225
ingestedAt: '2026-11-05T15:02:32.270Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: gadget: Move vbus draw to workqueue context

Currently dwc3_gadget_vbus_draw() can be called from atomic
context, which in turn invokes power-supply-core APIs. And
some these PMIC APIs have operations that may sleep, leading
to kernel panic.

Fix this by moving the vbus_draw into a workqueue context.

## Affected

- `Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < b214f0b11a0f1186f83c284f6a545110f76066b6`
- `Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < 76c1123ffccfaba95cf4ecc2a50f95504a522424`
- `Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < a7a80c25b65112768eeba58a7af129d3c52a6d90`
- `Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < 2333653ef854c2cc124077f71a8526f03bf6e06a`
- `Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < 74a231e3d99d310497ab0ccb359539a6063b316a`
- `Linux >= 99288de36020c5a6976df77e53ac449b0f75c97f < 54aaa3b387c2f580a99dc86a9cc2eb6dfaf599a7`
- `Linux 5.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.