CVE-2026-43170

What it actually does

This is a local denial-of-service flaw in the Linux kernel DWC3 USB gadget driver. The vulnerable code can call dwc3_gadget_vbus_draw() from atomic context, which then invokes power-supply-core or PMIC driver operations that may sleep. Sleeping from atomic context can trigger a kernel warning, BUG condition, or panic, causing the system to crash or reboot. The impact is availability-only; the issue does not directly provide code execution, privilege escalation, or data disclosure.

Why it matters to the business

Systems that expose or rely on the Linux DWC3 USB gadget stack, especially embedded, mobile, appliance, IoT, or USB device-mode products, may be susceptible to local crash conditions. A successful exploit can interrupt service, force device reboots, disrupt connected USB workflows, and reduce reliability of field-deployed devices. The CVSS score is moderate, EPSS is very low and flat, the issue is not in CISA KEV, and there is no reported exploit maturity, so broad internet-scale exploitation is unlikely; however, organizations with physical/local attacker exposure or shared local access should still prioritize kernel updates during normal maintenance cycles.

How an attack unfolds

An attacker first needs local access to a system where the affected Linux kernel is running with the DWC3 USB gadget functionality in use or reachable. The attacker then causes USB gadget or VBUS draw state changes that drive the vulnerable dwc3_gadget_vbus_draw() path from atomic context. Because that path can call into power-supply or PMIC operations that sleep, the kernel detects an invalid sleep-in-atomic-context condition or hits a related panic path. The result is a denial of service: the host or device crashes, reboots, or becomes unavailable until recovered. There is no indication from the provided data that this vulnerability is being used by ransomware groups, named threat actors, or known public exploit campaigns.

How to fix it

Apply a Linux kernel update from the operating system, device, or silicon vendor that includes the upstream fix for the DWC3 gadget change titled "usb: dwc3: gadget: Move vbus draw to workqueue context." No exact fixed package versions were provided, so use vendor advisories and kernel changelogs to identify the first fixed build for each distribution, appliance, embedded image, or BSP. Where immediate patching is not possible, reduce exposure by disabling unused USB gadget/device-mode functionality, restricting local shell access, limiting access to gadget configuration interfaces such as configfs, and preventing untrusted users from manipulating USB role, gadget, or power-supply state. For embedded products, rebuild and redeploy firmware images with the corrected kernel and validate PMIC/power-supply behavior under USB connect, disconnect, and role-switch events.

How to confirm the fix worked

Confirm the running kernel or firmware image includes the patch that moves VBUS draw handling into workqueue context. Validate using vendor package metadata, kernel changelogs, source review, or commit-level verification in the deployed kernel tree. On affected device classes, perform controlled USB gadget-mode testing, including repeated connect/disconnect, role switching, gadget enable/disable, and VBUS draw changes, while monitoring dmesg or kernel logs for sleep-in-atomic warnings, call traces, BUG messages, or panics involving dwc3_gadget_vbus_draw, power_supply_set_property, or PMIC drivers. The system should no longer emit invalid-context warnings or crash during those tests.

Typical attack path

1. Obtain local access to a vulnerable Linux system or device where DWC3 USB gadget mode is enabled or reachable.
2. Identify a way to trigger USB gadget VBUS draw changes, such as gadget reconfiguration, connect/disconnect behavior, role switching, or local gadget-control interfaces.
3. Trigger the vulnerable path so dwc3_gadget_vbus_draw() is invoked from atomic context.
4. Cause the function to call power-supply-core or PMIC operations that may sleep.
5. Trigger a kernel BUG, panic, or crash condition, resulting in system denial of service.

How to detect it

Look for evidence of prior kernel crashes or reboots correlated with USB gadget activity. Relevant sources include dmesg, journald, /var/log/kern.log, /var/log/messages, persistent pstore/ramoops logs, crash dumps, kdump vmcores, embedded serial console logs, and device management telemetry showing unexpected reboots. Search for sleep-in-atomic-context warnings, kernel BUG messages, call traces, or panics containing dwc3_gadget_vbus_draw, DWC3 gadget, power_supply_set_property, or PMIC driver functions. Correlate these events with local user activity, USB connect/disconnect events, gadget reconfiguration, configfs changes, role-switch events, or repeated device resets. Because this is a crash-only local DoS and no public exploitation is indicated, detection will usually rely on crash forensics and temporal correlation rather than unique network indicators.

• dwc3_gadget_vbus_draw
• BUG: sleeping function called from invalid context
• sleeping function called from invalid context
• in_atomic()
• power_supply_set_property
• power_supply_changed
• Call Trace:
• Kernel panic - not syncing
• dwc3
• DWC3
• usb: dwc3: gadget
• configfs-gadget
• /sys/kernel/config/usb_gadget
• /sys/class/power_supply
• pstore
• ramoops
• /sys/fs/pstore
• /var/log/kern.log
• /var/log/messages

What your security team should do

• Inventory Linux systems, embedded devices, appliances, and products that use the DWC3 USB gadget driver or USB device-mode functionality.
• Prioritize remediation for devices with local user access, exposed debug ports, kiosk/shared usage, physical attacker access, or critical availability requirements.
• Patch through vendor-supported kernel, firmware, BSP, or distribution updates that include the DWC3 gadget workqueue fix.
• If patching is delayed, disable unused USB gadget mode and restrict permissions for local interfaces that can reconfigure USB gadget or power-supply behavior.
• Monitor kernel logs for panic, BUG, or sleep-in-atomic traces involving DWC3 gadget and power-supply-core functions.
• Include this issue in embedded firmware regression testing, especially USB connect/disconnect and role-switch stress tests.
• Track vendor advisories because exact fixed versions were not provided in the input and may vary by distribution, kernel branch, and device vendor.