Linux Kernel CVE-2026-43170

CRITICAL conditions limiting exploitation: (1) USB gadget driver (dwc3) must be compiled and enabled in the kernel (CONFIG_USB_GADGET and CONFIG_USB_DWC3_GADGET); most server/desktop distributions have this disabled by default. (2) System must be configured to operate in USB device/gadget mode (not host mode); this is uncommon outside embedded systems, development devices, and Android phones. (3) The dwc3_gadget_vbus_draw() function must be invoked from atomic context simultaneously-this requires either explicit interrupt handler execution or internal kernel race condition. (4) Exploitation requires local authenticated access (PR:L per CVSS vector); unauthenticated remote exploitation is not possible. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/A:H) confirms: Attack Vector is LOCAL only, Privilege Requirement is LOW (authenticated local user), User Interaction is NONE, and Scope is UNCHANGED. The combination of disabled-by-default gadget drivers and local-only attack vector means production servers and standard desktop deployments face negligible risk; vulnerability is primarily relevant to embedded Linux, IoT devices, and systems explicitly using USB gadget functionality.

This vulnerability presents a disconnect between CVSS metrics and real-world exploitation likelihood. CVSS score of 5.5 (AV:L/AC:L/PR:L/S:U/A:H) indicates local, low-complexity denial of service requiring low privilege escalation-typical for kernel panics. However, EPSS score of 0.02% (5th percentile) strongly suggests minimal practical exploitation. The CVSS vector requires local access with authenticated user privileges (PR:L), which significantly constrains real-world attack surface compared to network-exploitable vulnerabilities. The denial-of-service impact is secondary (disruption rather than data breach or code execution). No active exploitation is documented (no KEV status provided, no public POC identified). The vulnerability requires specific conditions: the system must be using USB gadget functionality (not default on servers or most desktops), and an authenticated local user must trigger the vbus_draw code path. The extremely low EPSS percentile suggests researchers or attackers have not prioritized exploitation attempts. CVSS AC:L (low complexity) is misleading here-exploitation requires precise context timing (atomic context invocation) and gadget configuration, making practical complexity higher than the vector suggests. This is a real kernel correctness issue addressing scheduler constraint violation, but exploitation likelihood for denial of service in production remains low.

An authenticated local user on a system configured with USB gadget support (such as an embedded device, Android phone, or development system with CONFIG_USB_GADGET enabled) triggers the dwc3_gadget_vbus_draw() function by initiating USB gadget power negotiation while the kernel is in atomic context-for instance, during interrupt handling or spinlock-protected code path. The function invokes power-supply-core APIs that attempt to sleep (accessing PMIC over I2C), causing a kernel panic and immediate system denial of service. The attack requires no elevated privileges beyond normal user access, though triggering atomic context execution of the vulnerable code path requires either system configuration (USB gadget role) or internal kernel race condition timing.