Executive brief
A vulnerability in the Linux kernel's USB driver for Communication Device Class (CDC) Wireless Data Model (WDM) devices could allow an attacker to access sensitive information. Due to a technical error in how the system handles memory updates, the kernel might accidentally share uninitialized memory with a user. This could lead to the exposure of private data or cause system instability.
Technical details
A race condition exists in the drivers/usb/class/cdc-wdm.c component of the Linux kernel. Due to compiler optimization or CPU out-of-order execution, the update to 'desc->length' in the 'wdm_in_callback' function can be reordered before the 'memmove' operation that populates the buffer. Consequently, the 'wdm_read' function may perceive the updated length and execute 'copy_to_user' on uninitialized memory. This violates the Linux Kernel Memory Model (LKMM) data race rules. The issue has been resolved by implementing 'WRITE_ONCE' and appropriate memory barriers ('smp_wmb' and 'smp_rmb') to ensure proper execution ordering.
Affected products
- Linux Linux Kernel All versions prior to the 2026-03/04 patches
Timeline
- 2026-03-04: patched: Initial patch authored by Oliver Neukum
- 2026-05-08: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/170e8daca24da6edb4be82ab01abf44e87af387b
- https://git.kernel.org/stable/c/276aef0fd2b92f41b920ac891c72cadeee957934
- https://git.kernel.org/stable/c/4ee3062bf2c9a722afef429826e8607eaf3fc6a0
- https://git.kernel.org/stable/c/638328ca9c17ae6511ad62198c57bae32ffa3c91
- https://git.kernel.org/stable/c/67ed312124bb1b61858778ac0b985b48961c862a
- https://git.kernel.org/stable/c/8df672bfe3ec2268c2636584202755898e547173
- https://git.kernel.org/stable/c/c8fa96ed021923dae147bcd9f9205b8df7b82360