Memory leak in Linux kernel - CVE-2026-43432
Published: May 8, 2026
Vulnerability identifier: #VU130748
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-43432
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a memory leak in xhci_disable_slot() when handling error paths. A local user can trigger the vulnerable error path to cause a denial of service.
Triggering the issue requires specific hardware conditions or an abnormal device state.
How to mitigate CVE-2026-43432
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/078b446efc0f5e496c31bccb72b98af979963a83
- https://git.kernel.org/stable/c/1e800e26d54ccf2ddf2ea6d6cbe021c804d8aa62
- https://git.kernel.org/stable/c/2e2baa8fb5aa4d080cbfeb84c51eff797529f413
- https://git.kernel.org/stable/c/46aea90763832cd6e9b0c2e1c00e6a9512156d4b
- https://git.kernel.org/stable/c/6288baf0c8c4dcfbf206773aede9c1f2269cec28
- https://git.kernel.org/stable/c/807e4fb5140c73eb5dba1e399a990db5c1f3cdf8
- https://git.kernel.org/stable/c/c1c8550e70401159184130a1afc6261db01fc0ce
- https://git.kernel.org/stable/c/c65f1b840ab8ce72ba68f1b63bab7960f8fdfa89