CVE-2026-64233 in Linux
Summary
by MITRE • 07/24/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
uvc_function_bind() walks &opts->extension_units twice without holding opts->lock:
- directly, for the iExtension string-descriptor fixup loop; - indirectly, four times via uvc_copy_descriptors() (once per speed), where the helper iterates uvc->desc.extension_units (which aliases &opts->extension_units) to size and emit XU descriptors.
The configfs side (uvcg_extension_make / uvcg_extension_drop, in drivers/usb/gadget/function/uvc_configfs.c) takes opts->lock around its list_add_tail / list_del operations. A privileged userspace process that holds the configfs subtree open and writes the gadget UDC name to bind the function while concurrently rmdir()'ing an extensions subdir can race uvcg_extension_drop() against the bind-time list walks and dereference a freed struct uvcg_extension.
Hold opts->lock from the start of the XU string-descriptor fixup through the last uvc_copy_descriptors() call, releasing on the descriptor-error path via a new error_unlock label that drops the lock before falling through to the existing error label. This matches the locking discipline of the configfs callbacks and removes the only remaining unsynchronised reader of the XU list during bind.
Reachability: only privileged processes that can mount configfs and write to gadget UDC files can trigger the race, so this is a correctness fix rather than a security boundary.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability resides in the Linux kernel's USB gadget framework specifically within the UVC (USB Video Class) function implementation where a race condition occurs during the uvc_function_bind() function execution. This flaw manifests when the function performs two separate walks through the extension units list without proper synchronization, creating a potential for memory corruption and system instability. The technical implementation involves the uvc_function_bind() function executing a direct iteration over opts->extension_units for iExtension string-descriptor fixup operations followed by indirect iterations via uvc_copy_descriptors() calls that occur four times during different USB speed configurations. The core issue stems from the fact that while configfs side operations properly acquire opts->lock around list manipulation functions like list_add_tail and list_del, the bind-time operations fail to maintain consistent locking throughout their execution path.
The operational impact of this vulnerability extends beyond simple correctness issues into potential system stability threats, as a privileged userspace process capable of mounting configfs and writing to gadget UDC files can trigger the race condition. The scenario involves concurrent operations where a process holds the configfs subtree open while simultaneously writing the gadget UDC name to bind the function and performing rmdir() operations on extension subdirectories. This creates a timing window where uvcg_extension_drop() can execute concurrently with the bind-time list walks, potentially leading to dereferencing of freed memory structures. The vulnerability specifically affects struct uvcg_extension objects that become invalid during the race condition, creating opportunities for memory corruption that could escalate into system crashes or more serious stability issues.
The mitigation strategy implements a comprehensive locking solution that maintains opts->lock from the initial XU string-descriptor fixup phase through the final uvc_copy_descriptors() call execution. This approach establishes consistent locking discipline that mirrors the established patterns used in configfs callbacks, ensuring all readers of the extension units list maintain proper synchronization throughout the bind operation. The implementation introduces a new error_unlock label that properly releases the lock before proceeding to existing error handling paths, maintaining the existing error recovery mechanisms while adding the necessary synchronization. This solution directly addresses the root cause by eliminating the only remaining unsynchronized reader of the XU list during bind operations, effectively closing the race condition and ensuring memory safety throughout the USB gadget function initialization process.
The vulnerability classification aligns with CWE-362, which describes Concurrent Execution using Shared Resource with Improper Synchronization, and demonstrates characteristics consistent with ATT&CK technique T1068 where privilege escalation opportunities can arise from improper resource management. The fix maintains kernel security boundaries while addressing a correctness issue that could potentially be exploited by privileged processes to cause system instability through memory corruption attacks. This represents a defensive programming improvement that strengthens the kernel's USB gadget framework against race conditions and ensures proper memory lifecycle management during device configuration operations.
The resolution follows established kernel development practices for concurrent access control and maintains compatibility with existing UVC functionality while eliminating the race condition through consistent locking patterns. The solution demonstrates proper adherence to kernel locking conventions where shared data structures require exclusive access during modification or reading phases, preventing the scenario where freed memory could be accessed by concurrent operations. This approach ensures that USB gadget initialization remains stable even under concurrent system load conditions where multiple processes might attempt to configure UVC devices simultaneously through configfs interfaces.