CVE-2026-43170

A flaw was found in the Linux kernel's USB DWC3 gadget driver. This vulnerability occurs when the dwc3_gadget_vbus_draw() function is called from an atomic context, which then invokes power management integrated circuit (PMIC) APIs that may cause the system to sleep. An attacker could exploit this condition to trigger a kernel panic, leading to a Denial of Service (DoS) on the affected system.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access and is constrained to systems configured with DesignWare USB 3.0 controllers in peripheral gadget mode. Standard Red Hat server installations do not configure or expose USB gadget functions, significantly limiting real-world exposure. A local attacker triggering this flaw can only cause a kernel crash resulting in denial of service, without compromising host confidentiality or data integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.