Executive brief
The Linux kernel's USB driver subsystem contained a race condition where device probe operations could access USB device IDs after they had been freed by concurrent removal operations. An attacker with local access to the system could potentially trigger this race to cause a kernel crash or memory corruption by adding and removing USB dynamic IDs through sysfs while USB devices are being probed.
Technical details
The vulnerability is a use-after-free (UAF) race condition in the USB driver core (drivers/usb/core/driver.c). The root cause is that the usb_match_dynamic_id() function returned a pointer to a dynamically allocated ID structure that could be freed by remove_id_store() via sysfs while the probe operation was still running. The function failed to hold the usb_dynids_lock mutex for the duration of the returned pointer's use. The fix makes a local copy of the matched ID structure within the locked region, ensuring the data is valid after the lock is released. The race requires concurrent access: a device probe operation running at the same time as a sysfs remove_id operation. Local user access to sysfs is required to trigger the race condition.
Affected products
- Linux Linux kernel multiple versions prior to patches released 2026-09-14
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-09-14: patched: Fix merged by Greg Kroah-Hartman in Linux stable kernel branches