PT-2026-64567 · Linux · Linux
CVE-2026-64346
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: udc: Fix use-after-free in gadget match driver
The udc structure acts as the management structure for the gadget,
but their lifecycles are decoupled. A race condition exists where
usb del gadget() frees the udc memory (e.g., via mode-switch work)
while gadget match driver() concurrently accesses the freed udc memory
(e.g., via configfs), causing a Use-After-Free (UAF) that triggers a
NULL pointer dereference when the freed memory is zeroed:
[39430.908615][ T1171] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[39430.911397][ T1171] pc : pi strcmp+0x20/0x140
[39430.911441][ T1171] lr : gadget match driver+0x34/0x60
...
[39430.911890][ T1171] usb gadget register driver owner+0x50/0xf8
[39430.911910][ T1171] gadget dev desc UDC store+0xf4/0x140
[39430.931308][ T1171] configfs write iter+0xec/0x134
[39430.957058][ T1171] Workqueue: events freezable dwc3 set mode
[39430.957287][ T1171] dwc3 gadget exit+0x34/0x8c
[39430.957304][ T1171] dwc3 set mode+0xc0/0x664
Fix this by ensuring the udc structure remains allocated until the
gadget is released. To achieve this, introduce a new
usb gadget release() routine to the core. When the gadget is added,
usb add gadget() stores the gadget's release routine in the udc
structure and takes a reference to the udc. When the gadget is
released, usb gadget release() drops the reference to the udc and
then calls the gadget's release routine.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux