Skip to main content

Linux Kernel CVE-2026-43255

| EUVDEUVD-2026-27814 MEDIUM
2026-05-06 Linux GHSA-w929-9wq4-xrmp
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
May 11, 2026 - 20:30 vuln.today
CVSS changed
May 11, 2026 - 18:22 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: libertas: fix WARNING in usb_tx_block

The function usb_tx_block() submits cardp->tx_urb without ensuring that any previous transmission on this URB has completed. If a second call occurs while the URB is still active (e.g. during rapid firmware loading), usb_submit_urb() detects the active state and triggers a warning: 'URB submitted while active'.

Fix this by enforcing serialization: call usb_kill_urb() before submitting the new request. This ensures the URB is idle and safe to reuse.

AnalysisAI

A use-after-free condition in the libertas USB wireless driver allows local attackers with user privileges to cause a denial of service by triggering a kernel warning and potential crash through rapid firmware loading or repeated usb_tx_block() calls while a USB request is still active. The vulnerability stems from insufficient synchronization of USB URB submissions, enabling concurrent requests on the same URB without enforcing completion of prior transmissions.

Technical ContextAI

The libertas driver is a wireless network adapter driver in the Linux kernel that communicates with USB wireless devices. The usb_tx_block() function submits USB requests (URBs) for transmitting data to the device. The vulnerability exists because the function does not check or wait for previous USB requests on the same URB to complete before resubmitting. When usb_submit_urb() is called on an already-active URB (one with a pending transmission), the USB core detects this state violation and triggers a 'URB submitted while active' warning. Under certain conditions (such as rapid firmware loading sequences), this can escalate from a warning to a kernel panic or denial of service. The fix involves calling usb_kill_urb() before each new submission to guarantee the URB is in an idle state, ensuring proper serialization of USB operations.

RemediationAI

Update to patched kernel versions: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, or 7.0 and later. Apply the upstream fix commits available at https://git.kernel.org/stable/c/498525d8358d6d20918787e59736d5b6a021e9fd (and corresponding commits for other branches). For systems unable to immediately patch, disable libertas USB wireless driver modules if the hardware is not in use by unloading the module with 'modprobe -r libertas_usbhelper libertas_usb' or equivalent, though this will disable wireless connectivity on affected hardware. Restrict local system access to trusted users only to reduce the attack surface, as exploitation requires user-level privileges and the ability to trigger rapid firmware reloading or repeated usb_tx_block() calls. Avoid rapid firmware reloading or repeated wireless device initialization sequences while using vulnerable kernel versions.

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43255 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy