CVE-2026-43342

usb: gadget: f_rndis: Protect RNDIS options with mutex

MEDIUM
4.7
CVSS Score
Published: May 8, 2026 at 01:37 PM UTC
Updated: June 17, 2026 at 10:49 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM4.7
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_rndis: Protect RNDIS options with mutex The class/subclass/protocol options are suspectible to race conditions as they can be accessed concurrently through configfs. Use existing mutex to protect these options. This issue was identified during code inspection.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

4.14 ≤ v < 5.10.2534.14 ≤ v < 5.15.2034.14 ≤ v < 6.1.1684.14 ≤ v < 6.12.814.14 ≤ v < 6.18.224.14 ≤ v < 6.19.124.14 ≤ v < 6.6.1344.14 ≤ v < 7.05.11 ≤ v < 5.15.2035.16 ≤ v < 6.1.1686.13 ≤ v < 6.18.226.19 ≤ v < 6.19.126.2 ≤ v < 6.6.1346.7 ≤ v < 6.12.814.147.0 rc17.0 rc27.0 rc37.0 rc47.0 rc57.0 rc673517cf49bd449122b615d2b7a6bb835f02252e5
Vendor states this is fixed in 0a75d97c53477a59c0aa1c65f69038c719f9c5b8 (fixed)
Vendor states this is fixed in 209decd3f7901df9842b83f2540dc8685e344a07 (fixed)
Vendor states this is fixed in 446f1842cda929c40d4697722bfdcfb334bc9692 (fixed)
Vendor states this is fixed in 65b7dbf80a1627667c241fff7c1c224f3118014f (fixed)
Vendor states this is fixed in 7d8fa3b8783ab95a46e20d97fbeeede719b2efda (fixed)
Vendor states this is fixed in 8d8c68b1fc06ece60cf43e1306ff0f4ac121547e (fixed)
Vendor states this is fixed in c1b3d5b0acb194efe20fc5864ee03439fa7bd45c (fixed)
Vendor states this is fixed in cb5316b37288ab8791584e32f114c4f41ad45b67 (fixed)
Vendor states this is fixed in 4.14 (unaffected)
Vendor states this is fixed in 5.10.253 (unaffected)
Vendor states this is fixed in 5.15.203 (unaffected)
Vendor states this is fixed in 6.1.168 (unaffected)
Vendor states this is fixed in 6.12.81 (unaffected)
Vendor states this is fixed in 6.18.22 (unaffected)
Vendor states this is fixed in 6.19.12 (unaffected)
Vendor states this is fixed in 6.6.134 (unaffected)
Vendor states this is fixed in 7.0 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
HIGH
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-362

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card