Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-64346

usb: gadget: udc: Fix use-after-free in gadget_match_driver

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadget_match_driver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usb_del_gadget() frees the udc memory (e.g., via mode-switch work) while gadget_match_driver() concurrently accesses the freed udc memory (e.g., via configfs), causing a Use-After-Free (UAF) that triggers a NULL pointer dereference when the freed memory is zeroed: [39430.908615][ T1171] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [39430.911397][ T1171] pc : __pi_strcmp+0x20/0x140 [39430.911441][ T1171] lr : gadget_match_driver+0x34/0x60 ... [39430.911890][ T1171] usb_gadget_register_driver_owner+0x50/0xf8 [39430.911910][ T1171] gadget_dev_desc_UDC_store+0xf4/0x140 [39430.931308][ T1171] configfs_write_iter+0xec/0x134 [39430.957058][ T1171] Workqueue: events_freezable __dwc3_set_mode [39430.957287][ T1171] dwc3_gadget_exit+0x34/0x8c [39430.957304][ T1171] __dwc3_set_mode+0xc0/0x664 Fix this by ensuring the udc structure remains allocated until the gadget is released. To achieve this, introduce a new usb_gadget_release() routine to the core. When the gadget is added, usb_add_gadget() stores the gadget's release routine in the udc structure and takes a reference to the udc. When the gadget is released, usb_gadget_release() drops the reference to the udc and then calls the gadget's release routine.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • fc274c1e997314bf47f6a62c79b5d7e554ed59c4 to < 50eeb8e8a4f389efc91b93cff14a683e714ec194affected
  • fc274c1e997314bf47f6a62c79b5d7e554ed59c4 to < 7a5214dae906d9f58e07bc4995e8181ee74439f4affected
  • fc274c1e997314bf47f6a62c79b5d7e554ed59c4 to < d026f71df141c9b064ff32a78af5391a31ef75c2affected
  • fc274c1e997314bf47f6a62c79b5d7e554ed59c4 to < b52476a83d9e12df00765359d728a875b128bef1affected
  • fc274c1e997314bf47f6a62c79b5d7e554ed59c4 to < 54fa390aae393eb130f307a85562e3001cc39a52affected
  • fc274c1e997314bf47f6a62c79b5d7e554ed59c4 to < 67e511d2989eb1c8c588b599ce2fcc6bb8e6f7eaaffected

Linux Linux

Default version status: affected

  • 5.19affected
  • 0 to < 5.19unaffected
  • 6.1.178 to ≤ 6.1.*unaffected
  • 6.6.145 to ≤ 6.6.*unaffected
  • 6.12.96 to ≤ 6.12.*unaffected
  • 6.18.39 to ≤ 6.18.*unaffected
  • 7.1.4 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References