CyberSecBulletin
CVE-2026-43180NVD status: Modified

Linux: Concurrent Execution using Shared Resource with Improper Synchronization

Published Updated By the CyberSecBulletin desk

CVE-2026-43180 is a high-severity concurrent execution using shared resource with improper synchronization vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 443a830b1dc4f85c7560da59d4494b629feee215, 586318c2730433184c6f1d21183e346ddf25e81d, a2cd4b4db315a845a5603d08c9d03b11ddfc799d as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.1% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 443a830b1dc4f85c7560da59d4494b629feee215 or 586318c2730433184c6f1d21183e346ddf25e81d or a2cd4b4db315a845a5603d08c9d03b11ddfc799d or ef9b10a020503888eb6c8ed85a3d901a624ede4c, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.252 or 5.15.202 or 6.1.165 or 6.6.128, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 443a830b1dc4f85c7560da59d4494b629feee215; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 586318c2730433184c6f1d21183e346ddf25e81d; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, a2cd4b4db315a845a5603d08c9d03b11ddfc799d; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, ef9b10a020503888eb6c8ed85a3d901a624ede4c; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 9c79b839a63980c7da7ec5db895198045e154112; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, fc393af769af845d9985e2845e49553d8f015a64; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 8367c0e90126426e60581e4c07e1ec4411a0f843; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 64868f5ecadeb359a49bc4485bfa7c497047f13a; and 1 more ranges443a830b1dc4f85c7560da59d4494b629feee215, 586318c2730433184c6f1d21183e346ddf25e81d, a2cd4b4db315a845a5603d08c9d03b11ddfc799d, ef9b10a020503888eb6c8ed85a3d901a624ede4c, 9c79b839a63980c7da7ec5db895198045e154112, fc393af769af845d9985e2845e49553d8f015a64
LinuxLinux Kernel2.6.12.1 up to, but not including, 5.10.252; 5.11 up to, but not including, 5.15.202; 5.16 up to, but not including, 6.1.165; 6.2 up to, but not including, 6.6.128; 6.7 up to, but not including, 6.12.75; 6.13 up to, but not including, 6.18.16; 6.19 up to, but not including, 6.19.6; 2.6.12; and 1 more ranges5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls netif_stop_queue() and netif_wake_queue(). These are TX queue flow control functions unrelated to RX multicast configuration. The premature netif_wake_queue() can re-enable TX while tx_urb is still in-flight, leading to a double usb_submit_urb() on the same URB: kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); } kaweth_set_rx_mode() { netif_stop_queue(); netif_wake_queue(); // wakes TX queue before URB is done } kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); // URB submitted while active } This triggers the WARN in usb_submit_urb(): "URB submitted while active" This is a similar class of bug fixed in rtl8150 by - commit 958baf5eaee3 ("net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast"). Also kaweth_set_rx_mode() is already functionally broken, the real set_rx_mode action is performed by kaweth_async_set_rx_mode(), which in turn is not a no-op only at ndo_open() time.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Concurrent Execution using Shared Resource with Improper Synchronization

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

How developers prevent this class of flaw

  • In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
  • Use thread-safe capabilities such as the data access abstraction in Spring.
  • Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring. Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).

More Concurrent Execution using Shared Resource with Improper Synchronization vulnerabilities (CWE-362)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Concurrent Execution using Shared Resource with Improper Synchronization vulnerabilities

Spotted an error? Tell us.