CVE-2026-43427
Published May 8, 2026
Modified May 12, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: usb: class: cdc-wdm: fix reordering issue in read code path Quoting the bug report: Due to compiler optimization or CPU out-of-order execution, the desc->length update can be reordered before the memmove. If this happens, wdm_read() can see the new length and call copy_to_user() on uninitialized memory. This also violates LKMM data race rules [1]. Fix it by using WRITE_ONCE and memory barriers.
Is your site exposed to CVE-2026-43427?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
0.0001
Probability of exploitation
0.02%
Percentile rank
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
References
Other References
https://git.kernel.org/stable/c/170e8daca24da6edb4be82ab01abf44e87af387b
https://git.kernel.org/stable/c/276aef0fd2b92f41b920ac891c72cadeee957934
https://git.kernel.org/stable/c/4ee3062bf2c9a722afef429826e8607eaf3fc6a0
https://git.kernel.org/stable/c/638328ca9c17ae6511ad62198c57bae32ffa3c91
https://git.kernel.org/stable/c/67ed312124bb1b61858778ac0b985b48961c862a
https://git.kernel.org/stable/c/8df672bfe3ec2268c2636584202755898e547173
https://git.kernel.org/stable/c/c8fa96ed021923dae147bcd9f9205b8df7b82360
https://git.kernel.org/stable/c/e3c874b05901dc519054b5107d16620e6d2b5fea
Frequently Asked Questions
What is CVE-2026-43427? +
In the Linux kernel, the following vulnerability has been resolved:
usb: class: cdc-wdm: fix reordering issue in read code path
Quoting the bug report:
Due to compiler optimization or CPU out-of-order execution, the
desc->length update can be reordered before the memmove. If this
happens, wdm_read() can see the new length and call copy_to_user() on
uninitialized memory. This also violates LKMM data race rules [1].
Fix it by using WRITE_ONCE and memory barriers.
How do I check if I'm vulnerable to CVE-2026-43427? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.