PT-2026-64348 · Linux · Linux
CVE-2026-64233
·
Published
2026-07-24
·
Updated
2026-07-24
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: hold opts->lock across XU walks in uvc function bind
uvc function bind() walks &opts->extension units twice without holding
opts->lock:
- directly, for the iExtension string-descriptor fixup loop;
- indirectly, four times via uvc copy descriptors() (once per speed), where the helper iterates uvc->desc.extension units (which aliases &opts->extension units) to size and emit XU descriptors.
The configfs side (uvcg extension make / uvcg extension drop, in
drivers/usb/gadget/function/uvc configfs.c) takes opts->lock around its
list add tail / list del operations. A privileged userspace process
that holds the configfs subtree open and writes the gadget UDC name
to bind the function while concurrently rmdir()'ing an extensions
subdir can race uvcg extension drop() against the bind-time list walks
and dereference a freed struct uvcg extension.
Hold opts->lock from the start of the XU string-descriptor fixup
through the last uvc copy descriptors() call, releasing on the
descriptor-error path via a new error unlock label that drops the
lock before falling through to the existing error label. This
matches the locking discipline of the configfs callbacks and removes
the only remaining unsynchronised reader of the XU list during bind.
Reachability: only privileged processes that can mount configfs and
write to gadget UDC files can trigger the race, so this is a
correctness fix rather than a security boundary.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux