Executive brief
The Linux kernel's USB gadget interface contains a race condition in the device control interface (ioctl) handler. A concurrent USB device binding operation can cause the handler to operate on a stale NULL pointer, resulting in a crash. This affects systems that expose USB gadget functionality, potentially causing denial of service if the kernel oops occurs.
Technical details
The vulnerability is a race condition in gadget_dev_ioctl() within drivers/usb/gadget/legacy/inode.c. The function reads dev->gadget before acquiring the dev->lock spinlock, then checks dev->state after acquiring the lock. A concurrent bind operation can change the device state between these unsynchronized operations, leaving the function with a stale NULL gadget pointer. When the code subsequently dereferences gadget->ops->ioctl, a NULL pointer dereference occurs. The fix moves the gadget pointer read inside the spinlock to ensure consistent sampling of both the gadget pointer and device state. No CVSS score or exploitability details are provided in the advisory.
Affected products
- Linux Linux kernel multiple versions (patch applied across stable branches 2.6.11 through 7.2)
Timeline
- 2026-09-16: disclosed: CVE published
- 2026-09-14: patched: Fix committed by Greg Kroah-Hartman
- 2026-08-25: other: Original fix authored by Lovekesh Solanki