Executive brief
A vulnerability in the Linux kernel's USB Test and Measurement Class (USBTMC) driver could allow a local user to cause a denial-of-service condition. By providing an extremely long timeout value through a specific system command, a user can cause a kernel thread to hang indefinitely. This results in the affected process becoming unkillable and potentially impacting system stability or the availability of USB devices.
Technical details
The usbtmc driver in the Linux kernel was found to use unkillable waits when performing USB bulk message operations. Specifically, the driver accepts user-defined timeout values via ioctl commands and passes them to usb_bulk_msg(). Because usb_bulk_msg() uses unkillable waits, a user can provide an extremely large timeout value to effectively hang a kernel thread, making it unresponsive to signals. The vulnerability was resolved by replacing usb_bulk_msg() with usb_bulk_msg_killable() in usbtmc488_ioctl_trigger, send_request_dev_dep_msg_in, and usbtmc_read, allowing the wait to be interrupted if the process is terminated.
Affected products
- Linux Linux Kernel All versions prior to the fix in usbtmc.c
Timeline
- 2026-02-17: other: Patch authored by Alan Stern
- 2026-03-25: patched: Patch committed to stable tree
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0535f84cb94c9d8bcba0a2a5b3fac81b7d97235d
- https://git.kernel.org/stable/c/39bd4097292fd8564cf2cfba9356f8ab11e38d12
- https://git.kernel.org/stable/c/6cb7dc91f057dd8ce44f6caa2995d8e22784ed0a
- https://git.kernel.org/stable/c/72c0a063489be183cfb99e7050aaef503bdb6449
- https://git.kernel.org/stable/c/7784caa413a89487dd14dd5c41db8753483b2acb
- https://git.kernel.org/stable/c/7fa72c369c23c27d1f64883c1e276af950557fb1
- https://git.kernel.org/stable/c/d4f1c45bdff3f393f9ab7e76795901c442b9eb76