From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 41FD43F0745 for ; Fri, 8 May 2026 14:25:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778250313; cv=none; b=GJDzW8AVrxzLzefO1xYoIKBWjwfCrnMWCzRZUvZg3qPYNXJZWpL2WCVfgTVRhw8tKsFQT+Fz2NYxy3wERB4/0J1DOIKOYs/YXy8w3h/0qm3I2WIUgtS8m0MVp+lH6H73/YAYrtcFw183XTvkW2kQ/MOSt8+ZwhmMvgl6LsD99K0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778250313; c=relaxed/simple; bh=XskWTh5vFVg1XmXuRLPXiqvseaUPZVtJ4WwUEcEOWN4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=E+dad5xsUgWKfqvLAmaiSHqfQF3h4ajFFz7idNbOM8AEREpfRvHlrZBpoJ/o2pbsMMH3sTAv09k7MXxj/TKbdhXt0pU8OM422AnJA23xn7xw3Lt2gVKU/EsSTZ8j9XEcnUeVWl0FvyTOAAaEQPI4xUopb/Zfna0MYHb+8wR6WWw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=1Jtu3LxS; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="1Jtu3LxS" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BFE4AC2BCC9; Fri, 8 May 2026 14:25:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1778250313; bh=XskWTh5vFVg1XmXuRLPXiqvseaUPZVtJ4WwUEcEOWN4=; h=From:To:Cc:Subject:Date:Reply-To:From; b=1Jtu3LxSKRDUQxSGdrdtXIeYabn4hIPX1ouWVa1W5SSpw5sue20uA2Nr/3/Q+r8M6 s4mAI86yivBp2Zx/PI7WXF2u6ZkrSqJTbuM+SBDwZd/vgOL14Dj3wc5dyud7KlQhQT O4EJxaUjYFWSO4QQe0ou9t6hUNLteMygdMYhbNHY= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-43428: USB: core: Limit the length of unkillable synchronous timeouts Date: Fri, 8 May 2026 16:22:37 +0200 Message-ID: <2026050849-CVE-2026-43428-cbc1@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3907; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=nnWYlKBuBBiqDx7tXBDlAW2hmOS6lmAGu5f3mnkXQIs=; b=owGbwMvMwCRo6H6F97bub03G02pJDJl/P9Zpc4ffPX5Ujdf0mHPDHpVrGT8/5Djf3yYVI2V+6 FBjbhBDRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEzkGAPDgq7C1+7Lv3+eFfrz ZrBAzdaCK14+LgxzeGfNTqjjCWwrCZ1UE3ddoiP3dikXAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: USB: core: Limit the length of unkillable synchronous timeouts The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in usbcore allow unlimited timeout durations. And since they use uninterruptible waits, this leaves open the possibility of hanging a task for an indefinitely long time, with no way to kill it short of unplugging the target device. To prevent this sort of problem, enforce a maximum limit on the length of these unkillable timeouts. The limit chosen here, somewhat arbitrarily, is 60 seconds. On many systems (although not all) this is short enough to avoid triggering the kernel's hung-task detector. In addition, clear up the ambiguity of negative timeout values by treating them the same as 0, i.e., using the maximum allowed timeout. The Linux kernel CVE team has assigned CVE-2026-43428 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 5.10.253 with commit 4e86f5b79e62ded7e3c3ebd688cf5775e618148a Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 5.15.203 with commit 06d2bbc4c66c6b0e8a43728c4949026026a5be67 Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 6.1.167 with commit 6c62935670acdbb7687ced20494923b66fbb0367 Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 6.6.130 with commit 659c0c7d50a4b0f6aa197c4c098cfd91daf63862 Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 6.12.78 with commit 24b31a227f679a942d820840a4dea7f0c09a387f Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 6.18.19 with commit 64f3d75633aedc12bdff220e9a4337177430bd9d Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 6.19.9 with commit 2d34cb4d1d6283b4be9c78f4a83ed6956d3069ec Issue introduced in 2.6.12 with commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and fixed in 7.0 with commit 1015c27a5e1a63efae2b18a9901494474b4d1dc3 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-43428 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/usb/core/message.c include/linux/usb.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/4e86f5b79e62ded7e3c3ebd688cf5775e618148a https://git.kernel.org/stable/c/06d2bbc4c66c6b0e8a43728c4949026026a5be67 https://git.kernel.org/stable/c/6c62935670acdbb7687ced20494923b66fbb0367 https://git.kernel.org/stable/c/659c0c7d50a4b0f6aa197c4c098cfd91daf63862 https://git.kernel.org/stable/c/24b31a227f679a942d820840a4dea7f0c09a387f https://git.kernel.org/stable/c/64f3d75633aedc12bdff220e9a4337177430bd9d https://git.kernel.org/stable/c/2d34cb4d1d6283b4be9c78f4a83ed6956d3069ec https://git.kernel.org/stable/c/1015c27a5e1a63efae2b18a9901494474b4d1dc3