news.mlab.sh
Vulnerabilities
Vulnerability

CVE-2026-43170

Reference data from vuln.mlab.sh, coverage from our own index.

CVSS
5.5 Medium
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS
0.12%
Risk score
1.4
Published
2026-05-06
Status
Published

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Move vbus draw to workqueue context Currently dwc3_gadget_vbus_draw() can be called from atomic context, which in turn invokes power-supply-core APIs. And some these PMIC APIs have operations that may sleep, leading to kernel panic. Fix this by moving the vbus_draw into a workqueue context. A flaw was found in the Linux kernel's USB DWC3 gadget driver. This vulnerability occurs when the `dwc3_gadget_vbus_draw()` function is called from an atomic context, which then invokes power management integrated circuit (PMIC) APIs that may cause the system to sleep. An attacker could exploit this condition to trigger a kernel panic, leading to a Denial of Service (DoS) on the affected system.

Weaknesses

CWE-663

Coverage 3

Advisories and references