CVE-2026-64233
Received Received - Intake

USB Gadget UVC Extension List Race Condition

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind uvc_function_bind() walks &opts->extension_units twice without holding opts->lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times via uvc_copy_descriptors() (once per speed), where the helper iterates uvc->desc.extension_units (which aliases &opts->extension_units) to size and emit XU descriptors. The configfs side (uvcg_extension_make / uvcg_extension_drop, in drivers/usb/gadget/function/uvc_configfs.c) takes opts->lock around its list_add_tail / list_del operations. A privileged userspace process that holds the configfs subtree open and writes the gadget UDC name to bind the function while concurrently rmdir()'ing an extensions subdir can race uvcg_extension_drop() against the bind-time list walks and dereference a freed struct uvcg_extension. Hold opts->lock from the start of the XU string-descriptor fixup through the last uvc_copy_descriptors() call, releasing on the descriptor-error path via a new error_unlock label that drops the lock before falling through to the existing error label. This matches the locking discipline of the configfs callbacks and removes the only remaining unsynchronised reader of the XU list during bind. Reachability: only privileged processes that can mount configfs and write to gadget UDC files can trigger the race, so this is a correctness fix rather than a security boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-64233
EUVD
EUVD-2026-48642

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a race condition occurs during USB gadget UVC (Video Class) function binding. The issue involves improper locking when accessing extension units in the uvc_function_bind function, potentially allowing a privileged user to trigger a use-after-free scenario by manipulating configfs entries while the gadget is being bound.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB gadget UVC (USB Video Class) functionality and requires privileged access to configfs and gadget UDC files. Detection would involve checking kernel logs for errors related to uvc_function_bind or uvcg_extension operations during USB gadget binding.

Impact Analysis

The impact is limited to systems where a privileged user can mount configfs and modify gadget UDC files. It could cause system instability or crashes due to dereferencing freed memory, but does not directly expose sensitive data or allow privilege escalation beyond existing user privileges.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a correctness issue in the Linux kernel's USB gadget UVC functionality rather than a data exposure or privacy risk. The issue involves a race condition in privileged operations that could lead to system instability but does not involve unauthorized access to sensitive data.

Mitigation Strategies

Apply the latest kernel updates from your distribution to ensure the fix for CVE-2026-64233 is included. Restrict access to configfs and USB gadget configuration files to trusted users only. Monitor kernel logs for any related errors during USB gadget operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64233. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart