Linux Kernel CVE-2026-43250

Exploitation requires the target to be running the Linux ChipIdea UDC driver in USB peripheral/gadget mode with an active multi-segment (scatter-gather) DMA transfer in progress, and an abrupt USB disconnect at that moment followed by a reconnect where the gadget driver reuses the same request object without reinitializing it. Limiting factors: the attacker must control the USB connection (physical port or a controlling host), the flaw is a timing/race condition (disconnect must land during an in-flight transfer), it only affects systems that actually use the ChipIdea controller as a gadget (largely embedded/ARM SoC deployments, not general-purpose Linux hosts), and it triggers only when the gadget driver reuses the aborted request. It is not remotely reachable over a network and is not exploitable against systems using the controller in host-only mode.

Signals are broadly consistent in pointing to a low-to-moderate real-world priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H = 7.8) reflects high technical impact but requires local context, and the description makes clear the trigger is a physical USB disconnect during an active multi-segment transfer plus a gadget driver that reuses the request without reinitialization - conditions closer to a race than a deterministic, remotely reachable flaw. EPSS is very low (0.02%, 5th percentile) and the CVE is not listed in CISA KEV, with no public exploit identified, so this reads as a reliability/robustness hardening fix with corruption potential rather than a widely weaponizable target. Note a tension worth verifying: the NVD CVSS uses AV:L, but exploitation realistically depends on controlling the USB link (physical port manipulation or a malicious host), which is arguably physical rather than purely local - defenders should treat the practical attack surface as narrower than a generic local-privilege bug.

An attacker with physical or malicious-host control over the USB link to a Linux device running in gadget mode initiates a multi-segment DMA transfer and then abruptly disconnects mid-transfer, causing _ep_nuke() to return a request with stale DMA state. On reconnect, the gadget driver reuses the request, prompting the kernel to operate on freed/invalid DMA addresses, corrupting kernel memory and potentially crashing or destabilizing the device. No public proof-of-concept is identified, and the required disconnect-during-transfer race raises exploitation complexity.