CVE-2026-63905
Received Received - Intake

Use-After-Free in Linux Kernel USBIP VUDC Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: Fix use after free bug in vudc_remove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudc_remove(). The original thread stalled on Shuah Khan's request for runtime testing of the unplug/unbind path. This patch supplies that testing and keeps Zheng's original fix shape. In vudc_probe(), v_init_timer() binds udc->tr_timer.timer to v_timer(). usbip_sockfd_store() starts the timer via v_start_timer()/v_kick_timer(). vudc_remove() can then free the containing struct vudc while the timer is still pending or executing. KASAN confirms the race on an unpatched x86_64 QEMU guest with CONFIG_KASAN=y, CONFIG_USBIP_VUDC=y, CONFIG_USB_ZERO=y, and a tight loop that repeatedly writes a socket fd to usbip_sockfd, closes the socket pair, and unbinds/rebinds usbip-vudc.0: BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x8ba/0x8e0 Write of size 8 at addr ffff888001b80740 by task trigger_and_unb/239 Allocated by task 239: vudc_probe+0x4d/0xaa0 Freed by task 239: kfree+0x18f/0x520 device_release_driver_internal+0x388/0x540 unbind_store+0xd9/0x100 This lands in the timer core rather than v_timer() itself because the embedded timer_list is being walked after its containing struct vudc has already been freed. The underlying lifetime bug is the same one Zheng reported. With v_stop_timer() called from vudc_remove() and the timer deleted synchronously, the same harness completed 5000 bind/unbind iterations with no KASAN report.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63905
EUVD
EUVD-2026-45678

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's USB/IP virtual UDC driver. It occurs due to a race condition where a timer is started in vudc_probe() but not properly stopped before the containing device structure is freed in vudc_remove(). This can lead to the timer attempting to access freed memory, causing system instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB/IP virtual device controller (vudc) and involves a race condition leading to a use-after-free in vudc_remove(). Detection requires kernel debugging tools like KASAN (Kernel Address Sanitizer) enabled during compilation. Monitor kernel logs for slab-use-after-free errors related to timer operations in the USBIP subsystem. No direct network commands are applicable as this is a local kernel issue.

Impact Analysis

This vulnerability could cause system crashes or instability if exploited. An attacker with local access could trigger the race condition by repeatedly binding/unbinding the usbip-vudc device, potentially leading to kernel memory corruption or denial of service.

Compliance Impact

This vulnerability is a use-after-free bug in the Linux kernel's USB/IP virtual device controller (vudc) due to a race condition. It does not directly relate to data privacy or security controls required by GDPR or HIPAA. Compliance impact would depend on whether the affected system processes or stores regulated data, but the vulnerability itself is not a privacy or security control failure.

Mitigation Strategies

Apply the kernel patch that adds v_stop_timer() in vudc_remove() to delete the timer synchronously. Ensure your Linux kernel is updated to a version containing this fix. If immediate patching is not possible, disable the USBIP_VUDC module via kernel configuration (CONFIG_USBIP_VUDC=n) to prevent the vulnerable code path from being triggered.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63905. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart