Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-68370

usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback dummy_hcd embeds a single shared usb_request (dum->fifo_req) that the "emulated single-request FIFO" fast-path in dummy_queue() reuses for small IN transfers: it copies the caller's request into it (req->req = *_req) and queues it, treating list_empty(&fifo_req.queue) as "the slot is free". The completion side (dummy_timer/transfer/nuke/dummy_dequeue) follows the standard pattern: list_del_init(&req->queue) unlinks the request, then the lock is dropped and usb_gadget_giveback_request() invokes req->complete(). But list_del_init() makes fifo_req.queue look empty *before* the completion callback returns, so a concurrent dummy_queue() on another CPU sees the slot as free, reuses fifo_req and runs req->req = *_req -- overwriting req->complete while dummy_timer is mid-calling it. The indirect call then jumps to a clobbered pointer, causing a general protection fault / page fault in dummy_timer (syzkaller extid faf3a6cf579fc65591ca). The clobbering write is an in-bounds memcpy on a live shared object, so KASAN cannot flag it. Add a fifo_req_busy bit covering the shared request's whole lifetime: set it in dummy_queue() when the FIFO fast-path takes fifo_req (making it the fast-path guard, replacing the list_empty(&fifo_req.queue) test), and clear it after the completion callback has returned, via a dummy_giveback() helper used at all four gadget-request giveback sites. The shared slot can no longer be reused until its completion callback has finished.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 16a685172abc9233728830e27d26ffa778975b51affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 95f30a21612cc65761c58ba044b1767699437317affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3cab0e5498d0fbb21fe1a9181f7bda9a844a697eaffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < e2b2740f1242bc70b5b46da2cdbbaa419f490e59affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 67b589d09a96882d56842dced5698ed8dd06ce45affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < e239ea91b48180ed48a86ac25643832a02c88456affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < e24b33618231034bf01dfaff4fd3409d4b4d5b2eaffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < d5e5cd3654d2b5359a12ea6586120f05b28634eeaffected

Linux Linux

Default version status: affected

  • 2.6.12affected
  • 0 to < 2.6.12unaffected
  • 5.10.265 to ≤ 5.10.*unaffected
  • 5.15.216 to ≤ 5.15.*unaffected
  • 6.1.183 to ≤ 6.1.*unaffected
  • 6.6.148 to ≤ 6.6.*unaffected
  • 6.12.101 to ≤ 6.12.*unaffected
  • 6.18.42 to ≤ 6.18.*unaffected
  • 7.1.6 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References