Executive brief
A race condition vulnerability was discovered in the Linux kernel's USB RNDIS gadget driver. This component allows a Linux system to act as a virtual network card when connected to another computer via USB. An attacker with local access could exploit this flaw to cause system instability or a crash, potentially disrupting network services or the entire operating system.
Technical details
A race condition exists in the f_rndis component of the Linux kernel's USB gadget framework. The class, subclass, and protocol options are susceptible to concurrent access through configfs without proper synchronization. This lack of locking allows for a race condition during the rndis_bind process where IAD descriptor values are assigned. An attacker with local access to configfs could potentially trigger inconsistent state or kernel memory corruption. The fix introduces mutex locking (using scoped_guard in newer versions) to protect these options during access.
Affected products
- Linux Linux Kernel All versions prior to the 2026-04 patches
Timeline
- 2026-03-20: other: Vulnerability identified and patch authored
- 2026-04-18: patched: Patches committed to various stable kernel branches
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0a75d97c53477a59c0aa1c65f69038c719f9c5b8
- https://git.kernel.org/stable/c/209decd3f7901df9842b83f2540dc8685e344a07
- https://git.kernel.org/stable/c/446f1842cda929c40d4697722bfdcfb334bc9692
- https://git.kernel.org/stable/c/65b7dbf80a1627667c241fff7c1c224f3118014f
- https://git.kernel.org/stable/c/7d8fa3b8783ab95a46e20d97fbeeede719b2efda
- https://git.kernel.org/stable/c/8d8c68b1fc06ece60cf43e1306ff0f4ac121547e
- https://git.kernel.org/stable/c/c1b3d5b0acb194efe20fc5864ee03439fa7bd45c