PT-2026-61222 · Linux · Linux
CVE-2026-63905
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
usbip: vudc: Fix use after free bug in vudc remove due to race condition
This patch follows up Zheng Wang's 2023 report of a use-after-free in
vudc remove(). The original thread stalled on Shuah Khan's request for
runtime testing of the unplug/unbind path. This patch supplies that
testing and keeps Zheng's original fix shape.
In vudc probe(), v init timer() binds udc->tr timer.timer to v timer().
usbip sockfd store() starts the timer via v start timer()/v kick timer().
vudc remove() can then free the containing struct vudc while the timer is
still pending or executing.
KASAN confirms the race on an unpatched x86 64 QEMU guest with
CONFIG KASAN=y, CONFIG USBIP VUDC=y, CONFIG USB ZERO=y, and a tight loop
that repeatedly writes a socket fd to usbip sockfd, closes the socket
pair, and unbinds/rebinds usbip-vudc.0:
BUG: KASAN: slab-use-after-free in run timer base.part.0+0x8ba/0x8e0
Write of size 8 at addr ffff888001b80740 by task trigger and unb/239
Allocated by task 239:
vudc probe+0x4d/0xaa0
Freed by task 239:
kfree+0x18f/0x520
device release driver internal+0x388/0x540
unbind store+0xd9/0x100
This lands in the timer core rather than v timer() itself because the
embedded timer list is being walked after its containing struct vudc has
already been freed. The underlying lifetime bug is the same one Zheng
reported.
With v stop timer() called from vudc remove() and the timer deleted
synchronously, the same harness completed 5000 bind/unbind iterations
with no KASAN report.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux