Executive brief
The Linux kernel's USB gadget target mode function contains a race condition in the LUN (Logical Unit Number) teardown process that can lead to use-after-free memory access. When removing the last storage device from a target while a session is being torn down, kernel data structures can be freed prematurely while still in use, causing system crashes or undefined behavior.
Technical details
This vulnerability is a use-after-free (CWE-416) in the Linux kernel's USB gadget Target/LUN management code. The root cause is a race condition in the callback ordering: the port count was decremented in fabric_pre_unlink() before core_dev_del_lun() completed draining active LUN references. If the last LUN removal races with session (nexus) removal, the session can be freed prematurely via target_remove_session(), freeing sess_cmd_map while in-flight struct usbg_cmd work items are still executing. The fix introduces an optional fabric_post_unlink() callback that is invoked after core_dev_del_lun() completes, ensuring the port count remains nonzero until all LUN references are drained. Exploitation requires local access and specific timing to trigger the race condition, resulting in kernel BUG/Oops or DEBUG_OBJECTS warnings.
Affected products
- Linux Linux kernel Multiple versions (see stable branches linux-5.x through linux-7.x in kernel.org stable tree)
Timeline
- 2026-09-04: disclosed: Vulnerability resolved/published
- 2026-09-02: patched: Fix committed to stable branches by Greg Kroah-Hartman
- 2026-08-07: other: Patch authored by Shuangpeng Bai