The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - USB: dummy-hcd: Fix locking/synchronization error Syzbot testing was able to provoke an addressing     exception and crash in the usb_gadget_udc_reset() routine in drivers/usb/gadgets/udc/core.c, resulting     from the fact that the routine was called with a second (driver) argument of NULL. The bad caller was     set_link_state() in dummy_hcd.c, and the problem arose because of a race between a USB reset and driver     unbind. These sorts of races were not supposed to be possible; commit 7dbd8f4cabd9 (USB: dummy-hcd: Fix     erroneous synchronization change), along with a few followup commits, was written specifically to prevent     them. As it turns out, there are (at least) two errors remaining in the code. Another patch will address     the second error; this one is concerned with the first. The error responsible for the syzbot crash     occurred because the stop_activity() routine will sometimes drop and then re-acquire the dum->lock     spinlock. A call to stop_activity() occurs in set_link_state() when handling an emulated USB reset, after     the test of dum->ints_enabled and before the increment of dum->callback_usage. This allowed another thread     (doing a driver unbind) to sneak in and grab the spinlock, and then clear dum->ints_enabled and     dum->driver. Normally this other thread would have to wait for dum->callback_usage to go down to 0 before     it would clear dum->driver, but in this case it didn't have to wait since dum->callback_usage had not yet     been incremented. The fix is to increment dum->callback_usage _before_ calling stop_activity() instead of     after. Then the thread doing the unbind will not clear dum->driver until after the call to     usb_gadget_udc_reset() safely returns and dum->callback_usage has been decremented again. (CVE-2026-43327)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-43327

medium Nessus Plugin ID 313345

Version 1.8

Version 1.5

Version 1.3

Version 1.2

Version 1.1

Version 1.8 May 30, 2026, 6:41 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605300641
Version 1.5 May 25, 2026, 10:30 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605252230
Version 1.3 May 18, 2026, 10:04 AM CVSS metrics ("CVSSv2 score" set to 4.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 5.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H") Plugin Feed: 202605181004
Version 1.2 May 14, 2026, 3:47 AM CVSS metrics ("CVSSv2 score" set to 4.7) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 4.7) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H") CVSSv2 severity (based on CVE-2026-43327, severity decreased from "High" to "Medium") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202605140347
Version 1.1 May 9, 2026, 2:20 AM New Plugin Feed: 202605090220