CVE-2026-43343

usb: gadget: f_subset: Fix unbalanced refcnt in geth_free

MEDIUM

5.5

CVSS Score

Published: May 8, 2026 at 01:37 PM UTC

Updated: June 17, 2026 at 10:49 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_subset: Fix unbalanced refcnt in geth_free geth_alloc() increments the reference count, but geth_free() fails to decrement it. This prevents the configuration of attributes via configfs after unlinking the function. Decrement the reference count in geth_free() to ensure proper cleanup.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

3.11 ≤ v < 5.10.2533.11 ≤ v < 5.15.2033.11 ≤ v < 6.1.1683.11 ≤ v < 6.12.813.11 ≤ v < 6.18.223.11 ≤ v < 6.19.123.11 ≤ v < 6.6.1343.11 ≤ v < 7.05.11 ≤ v < 5.15.2035.16 ≤ v < 6.1.1686.13 ≤ v < 6.18.226.19 ≤ v < 6.19.126.2 ≤ v < 6.6.1346.7 ≤ v < 6.12.812832e56f88a981474ee4c7c141f46fc1b4454f43.11 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6

Vendor states this is fixed in 23e4851ce348a329d974e84e828155dda9f52122 (fixed)

Vendor states this is fixed in 3d436670b47415da042452618fb5d8e317ab095f (fixed)

Vendor states this is fixed in 3f5bfc550a40d7493b1cf09540ed6b412b3b82be (fixed)

Vendor states this is fixed in 75776a055b656873319c3830fed471daef3ceb23 (fixed)

Vendor states this is fixed in a932b171554714b1bca313b853c7aa9f2930f9aa (fixed)

Vendor states this is fixed in caa27923aacd8a5869207842f2ab1657c6c0c7bc (fixed)

Vendor states this is fixed in cc8ec610cd14c093a19371691a7ce1ee5421e829 (fixed)

Vendor states this is fixed in d7d702407b61e96286a15b6e715572f541a8d41c (fixed)

Vendor states this is fixed in 3.11 (unaffected)

Vendor states this is fixed in 5.10.253 (unaffected)

Vendor states this is fixed in 5.15.203 (unaffected)

Vendor states this is fixed in 6.1.168 (unaffected)