Executive brief
A vulnerability in the Linux kernel's USB core component could allow a system task to hang indefinitely. This occurs because certain USB communication functions allow unlimited timeout durations that cannot be interrupted by the user. In practice, this could lead to a local denial-of-service where a specific process becomes unresponsive and unkillable unless the physical USB device is unplugged.
Technical details
The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in the Linux kernel's usbcore component utilize uninterruptible waits. Prior to this fix, these APIs allowed for unlimited timeout durations (or treated negative values ambiguously), which could result in a task hanging indefinitely with no way to terminate it via standard signals. An attacker or a malfunctioning device could trigger this state to cause a local denial-of-service. The fix enforces a maximum synchronous timeout limit of 60 seconds for non-killable waits and standardizes the handling of zero or negative timeout values.
Affected products
- Linux Linux Kernel 2.6.12-rc2 to latest stable versions
Timeline
- 2026-02-17: other: Patch authored by Alan Stern
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/06d2bbc4c66c6b0e8a43728c4949026026a5be67
- https://git.kernel.org/stable/c/1015c27a5e1a63efae2b18a9901494474b4d1dc3
- https://git.kernel.org/stable/c/24b31a227f679a942d820840a4dea7f0c09a387f
- https://git.kernel.org/stable/c/2d34cb4d1d6283b4be9c78f4a83ed6956d3069ec
- https://git.kernel.org/stable/c/4e86f5b79e62ded7e3c3ebd688cf5775e618148a
- https://git.kernel.org/stable/c/64f3d75633aedc12bdff220e9a4337177430bd9d
- https://git.kernel.org/stable/c/659c0c7d50a4b0f6aa197c4c098cfd91daf63862