Improper resource shutdown or release in Linux kernel - CVE-2026-43479
Published: May 14, 2026
Vulnerability identifier: #VU131427
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-43479
CWE-ID: CWE-404
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows an attacker with physical access to cause a denial of service.
The vulnerability exists due to improper resource shutdown in the lan78xx USB network driver disconnect path when handling USB device disconnect. An attacker with physical access can disconnect a crafted USB network device to cause a denial of service.
How to mitigate CVE-2026-43479
Install security update from vendor's repository.