CVE-2026-43429 Linux CVE debrief

Who should care

Linux system maintainers, kernel patch managers, and administrators running systems with the USBTMC driver enabled or exposed to local users. It is most relevant where local access is possible and where availability of the kernel or a dependent service is important.

Technical summary

According to the CVE description, the usbtmc driver accepts timeout values from a user ioctl and uses them in some usb_bulk_msg() calls. Because usb_bulk_msg() uses unkillable waits, a user could supply an arbitrarily long timeout and cause a kernel thread to remain blocked. The kernel fix switches those calls to usb_bulk_msg_killable() so the wait can be interrupted instead of hanging indefinitely. NVD rates the issue CVSS 3.1 5.5/Medium with AV:L/PR:L/UI:N and impact concentrated on availability (A:H).

Defensive priority

Medium priority: the issue is local and availability-focused, but it can block kernel work for an unbounded time when USBTMC is in use. Patch or backport the kernel fix on affected systems that expose this driver to local users.

Recommended defensive actions

• Apply the upstream Linux kernel fix or backport the stable patch set referenced by NVD.
• Prioritize updates for kernels in the affected ranges listed by NVD, especially if USBTMC is enabled in your environment.
• Review whether untrusted local users can access USBTMC-related ioctl interfaces on your systems.
• If immediate patching is not possible, restrict local access and monitor for abnormal hangs in kernel threads related to USB device interactions.
• Track your kernel vendor's advisory or stable release that includes the usb_bulk_msg_killable() change.

Evidence notes

This debrief is based only on the supplied CVE/NVD corpus and official references. The CVE was published on 2026-05-08 and last modified on 2026-05-20. NVD marks the vulnerability as analyzed and links multiple stable.kernel.org patch references. NVD also lists affected Linux kernel version ranges spanning 4.19 through 6.19.9, plus several 7.0 release candidates. The weakness field is NVD-CWE-noinfo, so no narrower CWE is asserted here.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.