PT-2026-64567 · Linux · Linux
CVE-2026-64346
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: udc: Fix use-after-free in gadget match driver
The udc structure acts as the management structure for the gadget,
but their lifecycles are decoupled. A race condition exists where
usb del gadget() frees the udc memory (e.g., via mode-switch work)
while gadget match driver() concurrently accesses the freed udc memory
(e.g., via configfs), causing a Use-After-Free (UAF) that triggers a
NULL pointer dereference when the freed memory is zeroed:
[39430.908615][ T1171] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[39430.911397][ T1171] pc : pi strcmp+0x20/0x140
[39430.911441][ T1171] lr : gadget match driver+0x34/0x60
...
[39430.911890][ T1171] usb gadget register driver owner+0x50/0xf8
[39430.911910][ T1171] gadget dev desc UDC store+0xf4/0x140
[39430.931308][ T1171] configfs write iter+0xec/0x134
[39430.957058][ T1171] Workqueue: events freezable dwc3 set mode
[39430.957287][ T1171] dwc3 gadget exit+0x34/0x8c
[39430.957304][ T1171] dwc3 set mode+0xc0/0x664
Fix this by ensuring the udc structure remains allocated until the
gadget is released. To achieve this, introduce a new
usb gadget release() routine to the core. When the gadget is added,
usb add gadget() stores the gadget's release routine in the udc
structure and takes a reference to the udc. When the gadget is
released, usb gadget release() drops the reference to the udc and
then calls the gadget's release routine.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux