CVE-2026-63905 (GCVE-0-2026-63905)
Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-07-19 14:55
VLAI
EPSS
VEX
Title
usbip: vudc: Fix use after free bug in vudc_remove due to race condition
Summary
In the Linux kernel, the following vulnerability has been resolved:
usbip: vudc: Fix use after free bug in vudc_remove due to race condition
This patch follows up Zheng Wang's 2023 report of a use-after-free in
vudc_remove(). The original thread stalled on Shuah Khan's request for
runtime testing of the unplug/unbind path. This patch supplies that
testing and keeps Zheng's original fix shape.
In vudc_probe(), v_init_timer() binds udc->tr_timer.timer to v_timer().
usbip_sockfd_store() starts the timer via v_start_timer()/v_kick_timer().
vudc_remove() can then free the containing struct vudc while the timer is
still pending or executing.
KASAN confirms the race on an unpatched x86_64 QEMU guest with
CONFIG_KASAN=y, CONFIG_USBIP_VUDC=y, CONFIG_USB_ZERO=y, and a tight loop
that repeatedly writes a socket fd to usbip_sockfd, closes the socket
pair, and unbinds/rebinds usbip-vudc.0:
BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x8ba/0x8e0
Write of size 8 at addr ffff888001b80740 by task trigger_and_unb/239
Allocated by task 239:
vudc_probe+0x4d/0xaa0
Freed by task 239:
kfree+0x18f/0x520
device_release_driver_internal+0x388/0x540
unbind_store+0xd9/0x100
This lands in the timer core rather than v_timer() itself because the
embedded timer_list is being walked after its containing struct vudc has
already been freed. The underlying lifetime bug is the same one Zheng
reported.
With v_stop_timer() called from vudc_remove() and the timer deleted
synchronously, the same harness completed 5000 bind/unbind iterations
with no KASAN report.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
b6a0ca11186759ad7045d68a5447b1e89f658384 , < 61704e5cf9cd7464b510eb606e7e2978b1160a64
(git)
Affected: b6a0ca11186759ad7045d68a5447b1e89f658384 , < dcc1c90b28b28b7c493547506297e78653f81952 (git) Affected: b6a0ca11186759ad7045d68a5447b1e89f658384 , < 1036ac6148995feaf486014d32bf26bf993c06a9 (git) Affected: b6a0ca11186759ad7045d68a5447b1e89f658384 , < a0638db2340ee053ab0450656a763fd111475e54 (git) Affected: b6a0ca11186759ad7045d68a5447b1e89f658384 , < d07ed707467ce05ea9c03412d0c5ee9d0fe386a6 (git) Affected: b6a0ca11186759ad7045d68a5447b1e89f658384 , < 88d459e5b5a46da1ef9fd6f52d9439343edeec88 (git) Affected: b6a0ca11186759ad7045d68a5447b1e89f658384 , < 207bf80362df3fce8ebc9723351dcb1bc6d9ed0f (git) Affected: b6a0ca11186759ad7045d68a5447b1e89f658384 , < d96209626a29ea64666be98c30b30ac82e5f1be6 (git) |
guessed | |
| Linux | Linux |
Affected:
4.7
Unaffected: 0 , < 4.7 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/usbip/vudc_dev.c",
"drivers/usb/usbip/vudc_transfer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "61704e5cf9cd7464b510eb606e7e2978b1160a64",
"status": "affected",
"version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
"versionType": "git"
},
{
"lessThan": "dcc1c90b28b28b7c493547506297e78653f81952",
"status": "affected",
"version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
"versionType": "git"
},
{
"lessThan": "1036ac6148995feaf486014d32bf26bf993c06a9",
"status": "affected",
"version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
"versionType": "git"
},
{
"lessThan": "a0638db2340ee053ab0450656a763fd111475e54",
"status": "affected",
"version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
"versionType": "git"
},
{
"lessThan": "d07ed707467ce05ea9c03412d0c5ee9d0fe386a6",
"status": "affected",
"version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
"versionType": "git"
},
{
"lessThan": "88d459e5b5a46da1ef9fd6f52d9439343edeec88",
"status": "affected",
"version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
"versionType": "git"
},
{
"lessThan": "207bf80362df3fce8ebc9723351dcb1bc6d9ed0f",
"status": "affected",
"version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
"versionType": "git"
},
{
"lessThan": "d96209626a29ea64666be98c30b30ac82e5f1be6",
"status": "affected",
"version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/usbip/vudc_dev.c",
"drivers/usb/usbip/vudc_transfer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: vudc: Fix use after free bug in vudc_remove due to race condition\n\nThis patch follows up Zheng Wang\u0027s 2023 report of a use-after-free in\nvudc_remove(). The original thread stalled on Shuah Khan\u0027s request for\nruntime testing of the unplug/unbind path. This patch supplies that\ntesting and keeps Zheng\u0027s original fix shape.\n\nIn vudc_probe(), v_init_timer() binds udc-\u003etr_timer.timer to v_timer().\nusbip_sockfd_store() starts the timer via v_start_timer()/v_kick_timer().\nvudc_remove() can then free the containing struct vudc while the timer is\nstill pending or executing.\n\nKASAN confirms the race on an unpatched x86_64 QEMU guest with\nCONFIG_KASAN=y, CONFIG_USBIP_VUDC=y, CONFIG_USB_ZERO=y, and a tight loop\nthat repeatedly writes a socket fd to usbip_sockfd, closes the socket\npair, and unbinds/rebinds usbip-vudc.0:\n\n BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x8ba/0x8e0\n Write of size 8 at addr ffff888001b80740 by task trigger_and_unb/239\n Allocated by task 239:\n vudc_probe+0x4d/0xaa0\n Freed by task 239:\n kfree+0x18f/0x520\n device_release_driver_internal+0x388/0x540\n unbind_store+0xd9/0x100\n\nThis lands in the timer core rather than v_timer() itself because the\nembedded timer_list is being walked after its containing struct vudc has\nalready been freed. The underlying lifetime bug is the same one Zheng\nreported.\n\nWith v_stop_timer() called from vudc_remove() and the timer deleted\nsynchronously, the same harness completed 5000 bind/unbind iterations\nwith no KASAN report."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T14:55:12.270Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/61704e5cf9cd7464b510eb606e7e2978b1160a64"
},
{
"url": "https://git.kernel.org/stable/c/dcc1c90b28b28b7c493547506297e78653f81952"
},
{
"url": "https://git.kernel.org/stable/c/1036ac6148995feaf486014d32bf26bf993c06a9"
},
{
"url": "https://git.kernel.org/stable/c/a0638db2340ee053ab0450656a763fd111475e54"
},
{
"url": "https://git.kernel.org/stable/c/d07ed707467ce05ea9c03412d0c5ee9d0fe386a6"
},
{
"url": "https://git.kernel.org/stable/c/88d459e5b5a46da1ef9fd6f52d9439343edeec88"
},
{
"url": "https://git.kernel.org/stable/c/207bf80362df3fce8ebc9723351dcb1bc6d9ed0f"
},
{
"url": "https://git.kernel.org/stable/c/d96209626a29ea64666be98c30b30ac82e5f1be6"
}
],
"title": "usbip: vudc: Fix use after free bug in vudc_remove due to race condition",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63905",
"datePublished": "2026-07-19T14:55:12.270Z",
"dateReserved": "2026-07-19T07:54:57.020Z",
"dateUpdated": "2026-07-19T14:55:12.270Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-63905",
"date": "2026-09-14",
"epss": "0.0022",
"percentile": "0.12498"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-63905\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:08.260\",\"lastModified\":\"2026-07-27T17:44:23.777\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusbip: vudc: Fix use after free bug in vudc_remove due to race condition\\n\\nThis patch follows up Zheng Wang\u0027s 2023 report of a use-after-free in\\nvudc_remove(). The original thread stalled on Shuah Khan\u0027s request for\\nruntime testing of the unplug/unbind path. This patch supplies that\\ntesting and keeps Zheng\u0027s original fix shape.\\n\\nIn vudc_probe(), v_init_timer() binds udc-\u003etr_timer.timer to v_timer().\\nusbip_sockfd_store() starts the timer via v_start_timer()/v_kick_timer().\\nvudc_remove() can then free the containing struct vudc while the timer is\\nstill pending or executing.\\n\\nKASAN confirms the race on an unpatched x86_64 QEMU guest with\\nCONFIG_KASAN=y, CONFIG_USBIP_VUDC=y, CONFIG_USB_ZERO=y, and a tight loop\\nthat repeatedly writes a socket fd to usbip_sockfd, closes the socket\\npair, and unbinds/rebinds usbip-vudc.0:\\n\\n BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x8ba/0x8e0\\n Write of size 8 at addr ffff888001b80740 by task trigger_and_unb/239\\n Allocated by task 239:\\n vudc_probe+0x4d/0xaa0\\n Freed by task 239:\\n kfree+0x18f/0x520\\n device_release_driver_internal+0x388/0x540\\n unbind_store+0xd9/0x100\\n\\nThis lands in the timer core rather than v_timer() itself because the\\nembedded timer_list is being walked after its containing struct vudc has\\nalready been freed. The underlying lifetime bug is the same one Zheng\\nreported.\\n\\nWith v_stop_timer() called from vudc_remove() and the timer deleted\\nsynchronously, the same harness completed 5000 bind/unbind iterations\\nwith no KASAN report.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/usbip/vudc_dev.c\",\"drivers/usb/usbip/vudc_transfer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"61704e5cf9cd7464b510eb606e7e2978b1160a64\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"dcc1c90b28b28b7c493547506297e78653f81952\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"1036ac6148995feaf486014d32bf26bf993c06a9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"a0638db2340ee053ab0450656a763fd111475e54\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"d07ed707467ce05ea9c03412d0c5ee9d0fe386a6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"88d459e5b5a46da1ef9fd6f52d9439343edeec88\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"207bf80362df3fce8ebc9723351dcb1bc6d9ed0f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b6a0ca11186759ad7045d68a5447b1e89f658384\",\"lessThan\":\"d96209626a29ea64666be98c30b30ac82e5f1be6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/usbip/vudc_dev.c\",\"drivers/usb/usbip/vudc_transfer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.259\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.210\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.143\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.93\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.35\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1036ac6148995feaf486014d32bf26bf993c06a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/207bf80362df3fce8ebc9723351dcb1bc6d9ed0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/61704e5cf9cd7464b510eb606e7e2978b1160a64\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/88d459e5b5a46da1ef9fd6f52d9439343edeec88\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a0638db2340ee053ab0450656a763fd111475e54\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d07ed707467ce05ea9c03412d0c5ee9d0fe386a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d96209626a29ea64666be98c30b30ac82e5f1be6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dcc1c90b28b28b7c493547506297e78653f81952\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
"redhat_vex": {
"aggregate_severity": "None",
"current_release_date": "2026-07-21T14:03:16+00:00",
"cve": "CVE-2026-63905",
"id": "CVE-2026-63905",
"initial_release_date": "2026-07-19T00:00:00+00:00",
"product_status:known_not_affected": "274",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: usbip: vudc: Fix use after free bug in vudc_remove due to race condition",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63905.json",
"version": "3"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…