CVE-2026-43343

What it actually does

This is a Linux kernel USB gadget subsystem flaw in the Ethernet subset gadget function. The allocation path increments a reference count, but the free path fails to decrement it when the function is unlinked. The resulting unbalanced reference count prevents proper cleanup and can block later configuration of gadget attributes through configfs. The practical technical impact is a local denial of service against USB gadget configuration or reconfiguration; confidentiality and integrity are not directly affected.

Why it matters to the business

Systems that rely on Linux USB gadget functionality, such as embedded devices, appliances, development boards, mobile/IoT platforms, or devices exposing USB networking features, may lose the ability to reconfigure USB gadget attributes without administrative recovery such as restarting services, unloading modules, or rebooting. The issue is not known to be exploited in the wild, is not listed in CISA KEV, has very low EPSS, and requires local access, so broad internet-facing risk is low; however, operational disruption may matter for products that depend on dynamic USB gadget configuration.

How an attack unfolds

An attacker first needs local access with sufficient permission to manipulate USB gadget configuration through configfs. They create or use a USB gadget Ethernet subset function, link it into a gadget configuration, and then unlink or remove it in a sequence that triggers the flawed cleanup path. Because the kernel increments the function reference count during allocation but does not decrement it during free, the object is not fully cleaned up. Subsequent attempts to configure related USB gadget attributes through configfs can fail or become blocked, causing a denial-of-service condition for USB gadget management. Recovery may require reinitializing the gadget configuration, unloading/reloading affected modules where possible, or rebooting the device.

How to fix it

Apply a Linux kernel update that includes the upstream fix for the USB gadget f_subset reference-counting bug. If vendor fixed-version details are not available, update to the latest supported kernel from the operating system, device, or appliance vendor once the fix is included. For embedded products or custom kernels, backport the patch that decrements the reference count in geth_free() to ensure proper cleanup. As interim mitigation, restrict write access to USB gadget configfs, avoid delegating gadget-management permissions to untrusted local users, disable unused USB gadget functionality or affected modules where operationally feasible, and reboot or reinitialize affected devices if gadget configuration becomes stuck.

How to confirm the fix worked

Confirm the running kernel build includes the vendor or upstream fix for the USB gadget f_subset geth_free() reference-count cleanup. Validate exposure by checking whether USB gadget configfs is enabled and in use, typically under /sys/kernel/config/usb_gadget. Functional validation can be performed in a controlled test environment by creating, linking, unlinking, and then reconfiguring a USB gadget Ethernet subset function; after remediation, attributes should remain configurable after unlink/removal. Also verify that local non-administrative users cannot write to USB gadget configfs paths unless explicitly required.

Typical attack path

1. Obtain local access to a Linux system that has USB gadget functionality enabled.
2. Gain or use permissions sufficient to write to configfs USB gadget paths, commonly requiring elevated privileges or delegated device-management rights.
3. Create or manipulate a USB gadget Ethernet subset function.
4. Link the function into a gadget configuration.
5. Unlink or remove the function to trigger the cleanup path with the unbalanced reference count.
6. Attempt or cause subsequent USB gadget attribute reconfiguration to fail, disrupting USB gadget functionality until recovery action is taken.

How to detect it

There are no public reports of active exploitation, no CISA KEV listing, and no known ransomware use for this issue. To determine whether it was already abused, review local audit logs, shell histories, privileged command logs, and system logs for users or processes writing to USB gadget configfs paths, especially repeated creation, linking, unlinking, or removal of Ethernet gadget functions followed by configuration failures. Useful log sources include auditd, sudo logs, journald/syslog, endpoint telemetry, kernel logs, and file-integrity or EDR telemetry covering configfs. Investigate unexplained failures to modify USB gadget attributes, repeated gadget teardown/recreation, or recovery actions such as module reloads or reboots shortly after gadget configuration activity. Because exploitation is a local denial-of-service condition rather than code execution, durable forensic indicators may be limited unless audit or EDR logging captured configfs write operations.

• /sys/kernel/config/usb_gadget
• /sys/kernel/config/usb_gadget/*/functions/geth.*
• /sys/kernel/config/usb_gadget/*/configs/*/geth.*
• modprobe usb_f_subset
• modprobe g_ether
• rmmod usb_f_subset
• rmmod g_ether

What your security team should do

• Inventory Linux systems, appliances, and embedded devices that use USB gadget functionality, especially USB Ethernet gadget modes.
• Prioritize patching devices where local users, applications, containers, or management interfaces can manipulate configfs USB gadget settings.
• Update affected kernels using vendor-supported packages, or backport the upstream reference-count fix for custom or embedded kernels.
• Restrict write access to /sys/kernel/config/usb_gadget and review any service accounts or processes granted gadget-management privileges.
• Disable unused USB gadget functions or modules on systems that do not require them.
• Monitor for repeated USB gadget create/link/unlink activity or failed configfs writes that may indicate attempted denial of service.
• Document recovery procedures, such as gadget reinitialization, module reload, or reboot, for devices where USB gadget disruption affects operations.