FKIE_CVE-2026-64233

Vulnerability from fkie_nvd - Published: 2026-07-24 16:16 - Updated: 2026-11-08 16:10
Severity
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind uvc_function_bind() walks &opts->extension_units twice without holding opts->lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times via uvc_copy_descriptors() (once per speed), where the helper iterates uvc->desc.extension_units (which aliases &opts->extension_units) to size and emit XU descriptors. The configfs side (uvcg_extension_make / uvcg_extension_drop, in drivers/usb/gadget/function/uvc_configfs.c) takes opts->lock around its list_add_tail / list_del operations. A privileged userspace process that holds the configfs subtree open and writes the gadget UDC name to bind the function while concurrently rmdir()'ing an extensions subdir can race uvcg_extension_drop() against the bind-time list walks and dereference a freed struct uvcg_extension. Hold opts->lock from the start of the XU string-descriptor fixup through the last uvc_copy_descriptors() call, releasing on the descriptor-error path via a new error_unlock label that drops the lock before falling through to the existing error label. This matches the locking discipline of the configfs callbacks and removes the only remaining unsynchronised reader of the XU list during bind. Reachability: only privileged processes that can mount configfs and write to gadget UDC files can trigger the race, so this is a correctness fix rather than a security boundary.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2c9e0905ef7e69f7b814cd709613f6b3b5b98805Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5f1b9cff88982e2a2053d8b1fd983f7ccb9f03ccPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/68aa70648b625fa684bc0b71bbfd905f4943ca20Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/caec0145e5974e85fe5192fc6a6f5aa1a98f82a6Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e15c414092b3c24610cc771e481a723b0f645ecaPatch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel 7.1
linux linux_kernel 7.1
linux linux_kernel 7.1
linux linux_kernel 7.1
linux linux_kernel 7.1
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_uvc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e15c414092b3c24610cc771e481a723b0f645eca",
              "status": "affected",
              "version": "0525210c9840229e42c6b68e886c72a75a67cf8e",
              "versionType": "git"
            },
            {
              "lessThan": "2c9e0905ef7e69f7b814cd709613f6b3b5b98805",
              "status": "affected",
              "version": "0525210c9840229e42c6b68e886c72a75a67cf8e",
              "versionType": "git"
            },
            {
              "lessThan": "caec0145e5974e85fe5192fc6a6f5aa1a98f82a6",
              "status": "affected",
              "version": "0525210c9840229e42c6b68e886c72a75a67cf8e",
              "versionType": "git"
            },
            {
              "lessThan": "5f1b9cff88982e2a2053d8b1fd983f7ccb9f03cc",
              "status": "affected",
              "version": "0525210c9840229e42c6b68e886c72a75a67cf8e",
              "versionType": "git"
            },
            {
              "lessThan": "68aa70648b625fa684bc0b71bbfd905f4943ca20",
              "status": "affected",
              "version": "0525210c9840229e42c6b68e886c72a75a67cf8e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_uvc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "40AC3123-FD85-4602-A174-1E62052982CC",
              "versionEndExcluding": "6.6.143",
              "versionStartIncluding": "6.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E73413E-0629-41AA-A4D3-5A3D10A0BD63",
              "versionEndExcluding": "6.12.93",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382",
              "versionEndExcluding": "6.18.35",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3",
              "versionEndExcluding": "7.0.12",
              "versionStartIncluding": "6.19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uvc: hold opts-\u003elock across XU walks in uvc_function_bind\n\nuvc_function_bind() walks \u0026opts-\u003eextension_units twice without holding\nopts-\u003elock:\n\n  - directly, for the iExtension string-descriptor fixup loop;\n  - indirectly, four times via uvc_copy_descriptors() (once per speed),\n    where the helper iterates uvc-\u003edesc.extension_units (which aliases\n    \u0026opts-\u003eextension_units) to size and emit XU descriptors.\n\nThe configfs side (uvcg_extension_make / uvcg_extension_drop, in\ndrivers/usb/gadget/function/uvc_configfs.c) takes opts-\u003elock around its\nlist_add_tail / list_del operations.  A privileged userspace process\nthat holds the configfs subtree open and writes the gadget UDC name\nto bind the function while concurrently rmdir()\u0027ing an extensions\nsubdir can race uvcg_extension_drop() against the bind-time list walks\nand dereference a freed struct uvcg_extension.\n\nHold opts-\u003elock from the start of the XU string-descriptor fixup\nthrough the last uvc_copy_descriptors() call, releasing on the\ndescriptor-error path via a new error_unlock label that drops the\nlock before falling through to the existing error label.  This\nmatches the locking discipline of the configfs callbacks and removes\nthe only remaining unsynchronised reader of the XU list during bind.\n\nReachability: only privileged processes that can mount configfs and\nwrite to gadget UDC files can trigger the race, so this is a\ncorrectness fix rather than a security boundary."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: uvc: mantener opts -\u003e lock durante los recorridos XU en uvc_function_bind\n\nuvc_function_bind() recorre \u0026opts -\u003e extension_units dos veces sin mantener opts -\u003e lock:\n\n  - directamente, para el bucle de correcci\u00f3n del descriptor de cadena iExtension;\n  - indirectamente, cuatro veces a trav\u00e9s de uvc_copy_descriptors() (una vez por velocidad), donde la funci\u00f3n auxiliar itera uvc -\u003e desc.extension_units (que es un alias de \u0026opts -\u003e extension_units) para dimensionar y emitir descriptores XU.\n\nEl lado de configfs (uvcg_extension_make / uvcg_extension_drop, en drivers/usb/gadget/function/uvc_configfs.c) toma opts -\u003e lock alrededor de sus operaciones list_add_tail / list_del. Un proceso privilegiado de espacio de usuario que mantiene abierto el sub\u00e1rbol de configfs y escribe el nombre UDC del gadget para enlazar la funci\u00f3n mientras simult\u00e1neamente ejecuta rmdir() en un subdirectorio de extensiones puede competir con uvcg_extension_drop() contra los recorridos de lista en tiempo de enlace y desreferenciar una struct uvcg_extension liberada.\n\nMantener opts -\u003e lock desde el inicio de la correcci\u00f3n del descriptor de cadena XU hasta la \u00faltima llamada a uvc_copy_descriptors(), liberando en la ruta de error del descriptor a trav\u00e9s de una nueva etiqueta error_unlock que suelta el bloqueo antes de pasar a la etiqueta de error existente. Esto coincide con la disciplina de bloqueo de las retrollamadas de configfs y elimina el \u00fanico lector no sincronizado restante de la lista XU durante el enlace.\n\nAlcance: solo procesos privilegiados que pueden montar configfs y escribir en archivos UDC de gadget pueden desencadenar la condici\u00f3n de carrera, por lo que esta es una correcci\u00f3n de exactitud en lugar de un l\u00edmite de seguridad."
    }
  ],
  "id": "CVE-2026-64233",
  "lastModified": "2026-11-08T16:10:00.183",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-07-24T16:16:52.490",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/2c9e0905ef7e69f7b814cd709613f6b3b5b98805"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5f1b9cff88982e2a2053d8b1fd983f7ccb9f03cc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/68aa70648b625fa684bc0b71bbfd905f4943ca20"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/caec0145e5974e85fe5192fc6a6f5aa1a98f82a6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e15c414092b3c24610cc771e481a723b0f645eca"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.