CVE-2026-43427

usb: class: cdc-wdm: fix reordering issue in read code path

published May 8, 2026

CVSS
—
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

usb: class: cdc-wdm: fix reordering issue in read code path

Quoting the bug report:

Due to compiler optimization or CPU out-of-order execution, the

desc->length update can be reordered before the memmove. If this

happens, wdm_read() can see the new length and call copy_to_user() on

uninitialized memory. This also violates LKMM data race rules [1].

Fix it by using WRITE_ONCE and memory barriers.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00175 · 6.7th percentile
Published
2026-05-08T14:22Z
EPSS history
Timeline
  • 08 MAY 14:22Z
    usb: class: cdc-wdm: fix reordering issue in read code path
    cvelistv5