CVE-2026-43427

What it actually does

This is a Linux kernel race/order-of-operations flaw in the USB CDC WDM driver read path. A length field associated with a WDM descriptor can become visible to another execution context before the corresponding memory move has completed, allowing wdm_read() to copy uninitialized kernel memory to user space. The primary impact is local disclosure of kernel memory; depending on timing, device behavior, and surrounding kernel state, the flaw may also contribute to instability or denial of service. Exploitation requires local privileges and access to an affected CDC WDM device interface, such as /dev/cdc-wdm* exposed by some USB modems or WWAN devices.

Why it matters to the business

Systems using affected Linux kernels with CDC WDM-capable USB or WWAN devices may expose sensitive kernel memory to a local user or compromised low-privilege process. Leaked memory can contain data useful for further exploitation, such as kernel pointers, nearby secrets, or information that helps bypass hardening controls. Operational risk is highest on endpoints, embedded systems, appliances, or servers that expose modem-management interfaces to non-root users. The vulnerability is not currently listed in CISA KEV, has very low EPSS, and has no public exploit maturity reported, so broad opportunistic exploitation is less likely, but kernel memory disclosure flaws should still be prioritized where local users or untrusted workloads exist.

How an attack unfolds

An attacker first needs code execution as a local user on a Linux system running a vulnerable kernel and must be able to interact with a CDC WDM character device, typically exposed as /dev/cdc-wdm0 or a similar path. The attacker repeatedly performs reads against the WDM interface while device activity or crafted timing causes the driver read path to observe an updated descriptor length before the associated buffer content has been safely moved. When the race is won, the kernel copies bytes from uninitialized kernel memory into the attacker-controlled user-space buffer. The attacker can repeat the operation to collect leaked memory and then analyze it for sensitive data, kernel addresses, or other material useful for follow-on local privilege escalation. There are no named threat actors or ransomware campaigns currently associated with this issue.

How to fix it

Upgrade to a Linux kernel version that includes the CDC WDM read-path ordering fix using WRITE_ONCE and the required memory barriers in drivers/usb/class/cdc-wdm.c. Because exact fixed package versions were not provided, use the relevant distribution or appliance vendor advisory for the corrected kernel package and reboot into the updated kernel after installation. Where immediate patching is not possible, reduce exposure by restricting permissions on /dev/cdc-wdm* devices, ensuring only trusted administrative or modem-management services can access them; removing nonessential users from groups that grant modem or dialout device access; disabling or unloading the cdc_wdm module if CDC WDM functionality is not required; and limiting attachment of untrusted USB/WWAN devices. Kernel module blacklisting should be tested carefully because it may break cellular modem, WWAN, or device-management functionality.

How to confirm the fix worked

Confirm the running kernel is the patched vendor build, not only that the package is installed; check the active kernel with uname -a and verify after reboot. Review the vendor changelog or source package to confirm the CDC WDM fix is present in drivers/usb/class/cdc-wdm.c, specifically the corrected descriptor length update using WRITE_ONCE and memory-ordering barriers. Validate exposure by checking whether the cdc_wdm module is loaded and whether /dev/cdc-wdm* device nodes exist. Confirm device-node permissions and group ownership do not allow unnecessary local users or untrusted services to read from CDC WDM devices. If the driver is intentionally disabled, confirm it cannot be autoloaded and that required business functions still operate.

Typical attack path

1. Obtain local code execution on a Linux host running an affected kernel.
2. Identify whether the cdc_wdm driver is present and whether /dev/cdc-wdm* devices are accessible.
3. Open the CDC WDM device from user space with sufficient permissions.
4. Trigger repeated reads while causing or waiting for WDM device activity that exercises the vulnerable read path.
5. Win the ordering race so wdm_read() copies uninitialized kernel memory to the user-space buffer.
6. Analyze leaked memory for sensitive data, kernel pointers, or information useful for additional exploitation.
7. Optionally combine the leak with another local kernel vulnerability to improve reliability or bypass mitigations.

How to detect it

There is no reliable single log entry that proves exploitation, because successful exploitation may only return leaked memory to a local process without generating kernel errors. Focus detection on unusual local access to CDC WDM device nodes and suspicious process behavior. Useful sources include auditd rules for open/read access to /dev/cdc-wdm*, Linux process accounting, eBPF telemetry, endpoint detection logs, udev events, kernel logs, and shell/process execution history. Look for unexpected users or processes repeatedly opening /dev/cdc-wdm0, /dev/cdc-wdm1, or similar devices, especially scripts or custom binaries outside normal modem-management software. Review dmesg and journal logs for cdc_wdm-related warnings, kernel oopses, or crashes near suspicious device access, although absence of such logs does not rule out exploitation. If a suspicious process is found, preserve the binary, command line, parent process tree, open file descriptors, and any output files that may contain captured kernel memory.

What your security team should do

• Inventory Linux systems that use USB modems, WWAN adapters, embedded cellular modules, or expose /dev/cdc-wdm* devices.
• Prioritize kernel updates for multi-user systems, shared workstations, kiosks, embedded/edge devices, and systems running untrusted local workloads.
• Apply the vendor-provided fixed kernel and reboot systems to ensure the patched kernel is active.
• Restrict access to /dev/cdc-wdm* to only required trusted services and administrators.
• Disable or blacklist the cdc_wdm module on systems that do not require CDC WDM or WWAN modem-management functionality.
• Monitor for unexpected access to /dev/cdc-wdm* by nonstandard processes or users.
• Treat confirmed kernel memory disclosure as a potential precursor to local privilege escalation and perform broader host investigation if suspicious access is observed.