Executive brief
The Linux kernel contains a use-after-free vulnerability in USB device file handling that allows an unprivileged user with access to USB device nodes to trigger memory corruption. By performing a specific sequence of operations (mapping, submitting URBs, disconnecting, and unmapping), an attacker can cause the kernel to dereference freed memory, potentially leading to a system crash or other kernel instability.
Technical details
A use-after-free vulnerability exists in the usbdev_release() function within the USB usbfs subsystem. The root cause is that the function releases its reference to a usb_device structure before draining a list of completed async URBs (USB requests). During the drain operation, free_async() attempts to access the freed device via dec_usb_memory_use_count(), which dereferences offset 80 of the freed memory structure. This vulnerability is reachable by any unprivileged process with read/write access to a /dev/bus/usb node by: (1) mmapping the device file, (2) submitting a URB with a buffer in the mapped region, (3) unplugging the device, and (4) unmapping and closing the file descriptor. The fix relocates the usb_put_dev() call to after the async URB drain loop, ensuring the device structure remains valid during cleanup.
Affected products
- Linux Linux kernel through 6.12.94
Timeline
- 2026-09-04: disclosed