CVE-2026-68374 (GCVE-0-2026-68374)
Vulnerability from cvelistv5
Published
2026-08-10 12:03
Modified
2026-08-18 06:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: core: sysfs: add lock to bos_descriptors_read()
Add a lock to the function bos_descriptors_read().
This function accesses udev->bos, which could be simultaneously freed in
usb_reset_and_verify_device(), a function that is commonly called in
drivers all over the kernel.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/core/sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c07caee449c968842a350bfefa049889923b8240",
"status": "affected",
"version": "12fc84e8c4288cc8ed5f14a35e077130c2cfece2",
"versionType": "git"
},
{
"lessThan": "217774e143d7b5a88739193284b6421be3978601",
"status": "affected",
"version": "12fc84e8c4288cc8ed5f14a35e077130c2cfece2",
"versionType": "git"
},
{
"lessThan": "ab82adf5e63b2d89ead7933ab753b9cedbe028e9",
"status": "affected",
"version": "12fc84e8c4288cc8ed5f14a35e077130c2cfece2",
"versionType": "git"
},
{
"lessThan": "4e0197fbb0eec588795d5431716a244d9ac8fa93",
"status": "affected",
"version": "12fc84e8c4288cc8ed5f14a35e077130c2cfece2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/core/sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: sysfs: add lock to bos_descriptors_read()\n\nAdd a lock to the function bos_descriptors_read().\n\nThis function accesses udev-\u003ebos, which could be simultaneously freed in\nusb_reset_and_verify_device(), a function that is commonly called in\ndrivers all over the kernel."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached by a local read() on the world-readable sysfs attribute /sys/bus/usb/devices/*/bos_descriptors, and the racing reset is driven locally via the usbfs USBDEVFS_RESET ioctl or driver error recovery. No network or physical access to the bug itself is required.\nAC:L - The attacker controls both sides of the race: a loop of read() calls on the sysfs file plus repeated USBDEVFS_RESET ioctls (or induced driver resets), and the reset window spanning re-enumeration is milliseconds wide, so the race can be won reliably with retries.\nPR:L - The bos_descriptors binary attribute is BIN_ATTR_RO (0444), readable by any unprivileged local user; the device-reset side is available to the seat user through usbfs uaccess/plugdev ACLs on desktops, kiosks and containers with USB device access.\nUI:N - No victim action is needed; the attacker performs both the sysfs read and the device reset entirely on its own, with no cooperation from another user or process.\nS:U - The use-after-free corrupts and discloses kernel heap memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The memcpy reads from an already-kfree()d BOS buffer and copies up to 65535 bytes straight to userspace, and because wTotalLength itself is read from the reclaimed object the read can extend past the original allocation, leaking arbitrary reallocated kernel heap contents.\nI:H - This is a use-after-free on a kmalloc\u0027d object whose contents the attacker can influence by heap spraying into the freed slot; such UAFs on hot kernel slabs are a standard primitive for corrupting adjacent/reallocated kernel state and hijacking control flow.\nA:H - Dereferencing the freed usb_host_bos and copying a length derived from reclaimed memory readily runs off the end of the slab into unmapped or poisoned pages, producing a KASAN report, oops or panic that takes the machine down."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T06:55:59.462Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c07caee449c968842a350bfefa049889923b8240"
},
{
"url": "https://git.kernel.org/stable/c/217774e143d7b5a88739193284b6421be3978601"
},
{
"url": "https://git.kernel.org/stable/c/ab82adf5e63b2d89ead7933ab753b9cedbe028e9"
},
{
"url": "https://git.kernel.org/stable/c/4e0197fbb0eec588795d5431716a244d9ac8fa93"
}
],
"title": "usb: core: sysfs: add lock to bos_descriptors_read()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68374",
"datePublished": "2026-08-10T12:03:52.701Z",
"dateReserved": "2026-07-30T09:28:09.386Z",
"dateUpdated": "2026-08-18T06:55:59.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…