Executive brief
A race condition vulnerability was identified in the Linux kernel's YUREX USB driver. This flaw occurs during the device initialization process, potentially allowing system data to be overwritten or corrupted when a YUREX USB device is connected. While the impact is primarily limited to local system stability and data integrity, it could lead to unexpected system behavior or crashes.
Technical details
A race condition exists in the yurex_probe function within drivers/usb/misc/yurex.c of the Linux kernel. The vulnerability stems from the 'bbu' member of the device descriptor being initialized after the USB Request Block (URB) is submitted. If the URB completion handler (yurex_interrupt) executes before the initialization line is reached, it creates a window where probing logic can overwrite valid data retrieved from the device. An attacker with local access or the ability to plug in a malicious USB device could potentially trigger this race to cause memory corruption or a denial-of-service (system crash). The fix involves moving the initialization of 'dev->bbu' to occur before the 'usb_submit_urb' call.
Affected products
- Linux Linux kernel All versions prior to the fix in May 2026
Timeline
- 2026-02-09: other: Patch authored by Oliver Neukum
- 2026-05-08: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/3cec135415a89723e2d38e1c8cc5098203355965
- https://git.kernel.org/stable/c/687d26d43a5aaf44323ce7d601cf242bb87e9559
- https://git.kernel.org/stable/c/7a875c09899ba0404844abfd8f0d54cdc481c151
- https://git.kernel.org/stable/c/939e3d17b843b0bae70467fef4481069d73c8520
- https://git.kernel.org/stable/c/a41d3d9202e951995cfac6248c565423079c71fa
- https://git.kernel.org/stable/c/a7934d7202a39c3160aa30521c382c7b744ae4a2
- https://git.kernel.org/stable/c/a8b3b3d730acea1640bc89465f2832cf06a1e13a