usb: fix UAF when probe runs concurrent to dyn ID removal (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.21 % · percentile 11 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: usb: fix UAF when probe runs concurrent to dyn ID removal Dynamic IDs are only guaranteed to be valid when usb_dynids_lock is held, as remove_id_store can free the node. Thus, make a copy in usb_probe_interface. Clarify the documentation that the id parameter is only valid during the probe. USB serial has the same pattern, but it does not need fixing as the IDs cannot be removed via sysfs.
References
- https://git.kernel.org/stable/c/9b82ddf76827e2a8ff033a8131ecf24f2d6cae26
- https://git.kernel.org/stable/c/44904468e58d3dc3a0229782acbeb9677b060541
- https://git.kernel.org/stable/c/64320c6e721bdec4c43a789c866c8a099dd0c843
- https://git.kernel.org/stable/c/7e795801295c84a6bbc10a3e7a4c99c50bfe45ac
- https://git.kernel.org/stable/c/e6a9c6b79b70046afdf5a1dbd03b1104536f30c0
- https://git.kernel.org/stable/c/ef8154d8b52d60338c1fd8d793cd8e891c604c14
European references
- ENISA EUVD · EUVD-2026-82225
- GCVE · GCVE-0-2026-93117
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1289 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1253 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 0c7a2b72746a96f999fd2728520d03d94879be69 < 9b82ddf76827e2a8ff033a8131ecf24f2d6cae26 ; affected 0c7a2b72746a96f999fd2728520d03d94879be69 < 44904468e58d3dc3a0229782acbeb9677b060541 ; affected 0c7a2b72746a96f999fd2728520d03d94879be69 < 64320c6e721bdec4c43a789c866c8a099dd0c843 ; affected 0c7a2b72746a96f999fd2728520d03d94879be69 < 7e795801295c84a6bbc10a3e7a4c99c50bfe45ac ; affected 0c7a2b72746a96f999fd2728520d03d94879be69 < e6a9c6b79b70046afdf5a1dbd03b1104536f30c0 ; affected 0c7a2b72746a96f999fd2728520d03d94879be69 < ef8154d8b52d60338c1fd8d793cd8e891c604c14 |
| Linux · Linux | affected 2.6.33 ; unaffected 0 < 2.6.33 ; unaffected 6.1.188 ≤ 6.1.* ; unaffected 6.6.157 ≤ 6.6.* ; unaffected 6.12.110 ≤ 6.12.* ; unaffected 6.18.52 ≤ 6.18.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |