CVE-2026-93214
Received Received - Intake

Deadlock in Linux Kernel USB Gadget f_tcm

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() usbg_make_tpg() held dep_lock while calling configfs_depend_item_unlocked(), which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock dependency with configfs_rmdir(): dep_lock -> configfs root inode lock -> su_mutex -> dep_lock In usbg_make_tpg(), dep_lock only serialized the read of opts->ready, which is a monotonic flag that transitions from false to true exactly once (in tcm_set_name()) and never reverts. Remove dep_lock from usbg_make_tpg() entirely and use READ_ONCE/WRITE_ONCE to access opts->ready locklessly instead.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93214
EUVD
EUVD-2026-85943

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the USB gadget function driver for Target Channel Modules (f_tcm). It involves a deadlock in the usbg_make_tpg() function caused by improper lock ordering. The function holds dep_lock while calling configfs_depend_item_unlocked(), which acquires the configfs root inode lock, creating a circular dependency with configfs_rmdir(). The fix removes dep_lock from usbg_make_tpg() and uses lockless access with READ_ONCE/WRITE_ONCE for the opts->ready flag.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB gadget functionality and does not have network exposure. Detection requires checking kernel logs for deadlock errors related to usbg_make_tpg() or configfs operations. Use commands like dmesg | grep -i deadlock or journalctl -k | grep -i deadlock to search for relevant errors.

Impact Analysis

This vulnerability could cause system hangs or deadlocks when USB gadget functionality is used, potentially leading to denial of service. Systems relying on USB target mode storage could become unresponsive, disrupting operations that depend on this functionality.

Compliance Impact

This vulnerability is a local denial-of-service issue in the Linux kernel's USB gadget driver, caused by a deadlock in the f_tcm module. It does not directly impact data confidentiality, integrity, or privacy, which are key concerns for GDPR and HIPAA compliance.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, avoid using USB gadget configurations that rely on f_tcm until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93214. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart