Skip to main content

Linux Kernel CVE-2026-43136

| EUVDEUVD-2026-27696 MEDIUM
2026-05-06 Linux GHSA-h8pw-w24f-rm6q
Denial Of Service Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.6 MEDIUM

Attack requires physical USB gadget insertion (AV:P); attacker controls external device, not the target system (PR:N); impact is kernel crash only (A:H, C:N, I:N).

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:10 vuln.today
CVSS changed
May 12, 2026 - 21:22 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()

Do not crash when a report has no fields.

Fake USB gadgets can send their own HID report descriptors and can define report structures without valid fields. This can be used to crash the kernel over USB.

AnalysisAI

Kernel denial-of-service via crafted USB HID descriptor in the Linux logitech-hidpp driver allows an attacker controlling a USB gadget device to crash the kernel by presenting a report descriptor with zero fields. The missing maxfield bounds check in hidpp_get_report_length() causes the kernel to dereference invalid memory when the hid-logitech-hidpp module processes the malformed descriptor. No active exploitation confirmed (not in CISA KEV), and EPSS at 0.02% (7th percentile) reflects very low real-world exploitation probability despite the broad Linux kernel footprint.

Technical ContextAI

The flaw resides in drivers/hid/hid-logitech-hidpp.c within the HID (Human Interface Device) subsystem of the Linux kernel. When a USB device matching Logitech HID++ identifiers is connected, the kernel automatically loads the hid-logitech-hidpp module and calls hidpp_get_report_length() to parse HID report descriptors. The vulnerability is a missing bounds check: when a fake USB gadget - constructed with hardware like FaceDancer or a Linux OTG gadget - presents a valid HID descriptor but specifies zero report fields (maxfield=0), the function iterates over nonexistent field data, triggering a NULL dereference or out-of-bounds read that crashes the kernel. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* spans all affected branches. No CWE was formally assigned, but the root cause class is a missing input validation check (analogous to CWE-20 or CWE-476) on externally-supplied descriptor data.

RemediationAI

Update the Linux kernel to a patched stable release: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, or 7.0. The upstream fix is confirmed via multiple kernel.org stable branch commits referenced in the CVE. Ubuntu users should apply the update documented in USN-8492-1 at https://ubuntu.com/security/notices/USN-8492-1. Red Hat and SUSE users should monitor vendor advisories. Where immediate patching is not feasible, compensating controls include: disabling USB ports in BIOS/UEFI (eliminates the attack surface entirely but breaks legitimate USB peripherals); using kernel USB authorization to block unrecognized devices via 'echo 0 > /sys/bus/usb/devices/usbX/authorized' (requires per-device management and may disrupt workflows); or blacklisting the hid-logitech-hidpp kernel module via 'blacklist hid-logitech-hidpp' in /etc/modprobe.d/ (prevents loading but breaks all Logitech HID++ devices). The blacklist approach is the least disruptive targeted mitigation.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43136 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy