Executive brief
A race condition in the Linux kernel's USB gadget subsystem could allow a local attacker to cause a system crash. The issue occurs when the system attempts to manage USB device controllers while they are simultaneously being disconnected or reconfigured. This primarily impacts system stability and availability, potentially leading to a denial-of-service.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's USB gadget subsystem within the gadget_match_driver function. The root cause is the decoupled lifecycles of the 'udc' management structure and the gadget itself. A race condition occurs when usb_del_gadget() frees the udc memory (often triggered by mode-switch work) while gadget_match_driver() concurrently attempts to access that same memory via configfs. This results in a NULL pointer dereference when the freed memory is zeroed. The fix introduces a new reference counting mechanism (usb_gadget_release) to ensure the udc structure remains allocated until the gadget is fully released. Patches have been merged into multiple stable kernel branches.
Affected products
- Linux Linux Kernel All versions prior to fixed stable releases (e.g., 5.10.223, 5.15.164, 6.1.102, 6.6.43, 6.9.12, 6.10.2)
Timeline
- 2026-06-25: disclosed: Initial patch submission by Jimmy Hu
- 2026-07-24: patched: Commits merged into stable kernel trees
- 2026-07-25: advisory: CVE-2026-64346 published
References
- https://git.kernel.org/stable/c/50eeb8e8a4f389efc91b93cff14a683e714ec194
- https://git.kernel.org/stable/c/54fa390aae393eb130f307a85562e3001cc39a52
- https://git.kernel.org/stable/c/67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea
- https://git.kernel.org/stable/c/7a5214dae906d9f58e07bc4995e8181ee74439f4
- https://git.kernel.org/stable/c/b52476a83d9e12df00765359d728a875b128bef1
- https://git.kernel.org/stable/c/d026f71df141c9b064ff32a78af5391a31ef75c2
- https://git.kernel.org/stable/c/f845852a5a8914277031f47d8de0f350fef52405