Executive brief
A vulnerability was identified in the Linux kernel's USBIP Virtual USB Device Controller (VUDC) driver. This component allows for the simulation of USB devices over a network. An attacker could exploit a race condition during device removal to cause a system crash or potentially execute unauthorized actions by triggering a 'use-after-free' error.
Technical details
A use-after-free vulnerability exists in the usbip vudc driver due to a race condition in the vudc_remove() function. The driver fails to synchronously stop and delete the tr_timer before freeing the vudc structure. If the timer expires or is being processed while the structure is being freed, the kernel attempts to access memory that has already been released. This was confirmed via KASAN during rapid bind/unbind cycles. The fix involves calling timer_delete_sync() within v_stop_timer() during the removal process to ensure the timer is no longer active before memory deallocation.
Affected products
- Linux Linux kernel b6a0ca111867 to 61704e5cf9cd7464b510eb606e7e2978b1160a64
Timeline
- 2023-03-17: disclosed: Initial report by Zheng Wang
- 2026-04-17: patched: Patch submitted with runtime testing results
- 2026-07-19: advisory: CVE published
References
- https://git.kernel.org/stable/c/1036ac6148995feaf486014d32bf26bf993c06a9
- https://git.kernel.org/stable/c/207bf80362df3fce8ebc9723351dcb1bc6d9ed0f
- https://git.kernel.org/stable/c/61704e5cf9cd7464b510eb606e7e2978b1160a64
- https://git.kernel.org/stable/c/88d459e5b5a46da1ef9fd6f52d9439343edeec88
- https://git.kernel.org/stable/c/a0638db2340ee053ab0450656a763fd111475e54
- https://git.kernel.org/stable/c/d07ed707467ce05ea9c03412d0c5ee9d0fe386a6
- https://git.kernel.org/stable/c/d96209626a29ea64666be98c30b30ac82e5f1be6