Skip to main content

Linux Kernel CVE-2026-43223

| EUVDEUVD-2026-27786 MEDIUM
Memory Leak (CWE-401)
2026-05-06 Linux GHSA-69m6-gcw2-m2rp
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Requires physical USB device, loaded module, and local low-privilege access; impact is availability-only (kernel warning/USB subsystem disruption), no data exposure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:59 vuln.today
CVSS changed
May 08, 2026 - 21:22 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: pvrusb2: fix URB leak in pvr2_send_request_ex

When pvr2_send_request_ex() submits a write URB successfully but fails to submit the read URB (e.g. returns -ENOMEM), it returns immediately without waiting for the write URB to complete. Since the driver reuses the same URB structure, a subsequent call to pvr2_send_request_ex() attempts to submit the still-active write URB, triggering a 'URB submitted while active' warning in usb_submit_urb().

Fix this by ensuring the write URB is unlinked and waited upon if the read URB submission fails.

AnalysisAI

URB (USB Request Block) leak in the Linux kernel pvrusb2 media driver causes a denial-of-service condition on systems with Hauppauge WinTV-PVR USB2 capture devices. The pvr2_send_request_ex() function fails to unlink and await the write URB before returning on read URB submission failure, leaving the URB in an active state; subsequent driver calls trigger a 'URB submitted while active' kernel warning that destabilizes the USB subsystem. No public exploit exists and EPSS is 0.02% (7th percentile), but vendor-released patches are available across all major stable kernel branches.

Technical ContextAI

The vulnerability resides in drivers/media/usb/pvrusb2/, the kernel driver for the Hauppauge WinTV-PVR USB2 analog capture device. Root cause is CWE-401 (Missing Release of Memory after Effective Lifetime): the driver reuses a single statically-allocated URB structure for paired write/read USB control transfers. When pvr2_send_request_ex() successfully submits the write URB but then encounters an error (e.g., -ENOMEM) during read URB submission, it exits immediately without calling usb_unlink_urb() or waiting on the write URB completion callback. The kernel USB core's usb_submit_urb() enforces that a URB cannot be resubmitted while active, so the next call to the function triggers an internal consistency warning. The CPE identifier cpe:2.3:a:linux:linux confirms this spans the kernel codebase from the initial commit forward to each stable branch's respective fix commit.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, or 7.0, selecting the branch appropriate for the deployed kernel series. Upstream fix commits are available at https://git.kernel.org/stable/c/da524c939b1e5ba17f10db4bde4bdaf569ffcda6 and sibling commits across branches (see full reference list). Ubuntu users should apply USN-8492-1; Red Hat and SUSE users should monitor their respective security advisories. As an interim workaround where immediate patching is not feasible, unload the pvrusb2 module with 'modprobe -r pvrusb2' - this eliminates the vulnerable code path entirely but disables the Hauppauge capture device. To prevent automatic reload on USB device insertion, add 'blacklist pvrusb2' to /etc/modprobe.d/blacklist.conf; note this renders the capture hardware non-functional until the module is re-enabled post-patch.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43223 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy