Executive brief
A vulnerability in the Linux kernel's USB gadget driver can lead to a resource management error. Specifically, the system fails to properly release reference counts when a USB network function is unlinked. This can prevent administrators from reconfiguring certain system attributes, potentially leading to operational issues or a partial denial of service for USB-related configurations.
Technical details
A reference count leak exists in the 'f_subset' USB gadget driver within the Linux kernel. The 'geth_alloc()' function correctly increments the reference count for the function instance, but the corresponding 'geth_free()' function fails to decrement it upon unlinking. This unbalanced reference count prevents the cleanup of the function instance and subsequently blocks the configuration of attributes via configfs. An attacker with local access could potentially exploit this to cause a resource leak or prevent legitimate system configuration changes. The fix involves adding a scoped mutex guard to safely decrement the reference count in 'geth_free()'.
Affected products
- Linux Linux Kernel All versions including and prior to 6.13.y
Timeline
- 2026-03-20: other: Patch submitted by developer
- 2026-04-11: patched: Patch committed to stable trees
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/23e4851ce348a329d974e84e828155dda9f52122
- https://git.kernel.org/stable/c/3d436670b47415da042452618fb5d8e317ab095f
- https://git.kernel.org/stable/c/3f5bfc550a40d7493b1cf09540ed6b412b3b82be
- https://git.kernel.org/stable/c/75776a055b656873319c3830fed471daef3ceb23
- https://git.kernel.org/stable/c/a932b171554714b1bca313b853c7aa9f2930f9aa
- https://git.kernel.org/stable/c/caa27923aacd8a5869207842f2ab1657c6c0c7bc
- https://git.kernel.org/stable/c/cc8ec610cd14c093a19371691a7ce1ee5421e829