CVE-2026-64346 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: udc: Fix use-after-free in gadget_match_driver
The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usb_del_gadget() frees the udc memory (e.g., via mode-switch work) while gadget_match_driver() concurrently accesses the freed udc memory (e.g., via configfs), causing a Use-After-Free (UAF) that triggers a NULL pointer dereference when the freed memory is zeroed:
[39430.908615][ T1171] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[39430.911397][ T1171] pc : __pi_strcmp+0x20/0x140
[39430.911441][ T1171] lr : gadget_match_driver+0x34/0x60
... [39430.911890][ T1171] usb_gadget_register_driver_owner+0x50/0xf8
[39430.911910][ T1171] gadget_dev_desc_UDC_store+0xf4/0x140
[39430.931308][ T1171] configfs_write_iter+0xec/0x134
[39430.957058][ T1171] Workqueue: events_freezable __dwc3_set_mode
[39430.957287][ T1171] dwc3_gadget_exit+0x34/0x8c
[39430.957304][ T1171] __dwc3_set_mode+0xc0/0x664
Fix this by ensuring the udc structure remains allocated until the gadget is released. To achieve this, introduce a new usb_gadget_release() routine to the core. When the gadget is added, usb_add_gadget() stores the gadget's release routine in the udc structure and takes a reference to the udc. When the gadget is released, usb_gadget_release() drops the reference to the udc and then calls the gadget's release routine.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability represents a critical use-after-free condition in the Linux kernel's USB gadget subsystem that occurs during concurrent operations involving device mode switching and driver matching processes. The flaw exists within the usb: gadget: udc framework where the udc (USB Device Controller) structure serves as the management entity for gadget operations but operates with independently managed lifecycles. The race condition manifests when usb_del_gadget() executes in one execution context and simultaneously frees the udc memory structure, while gadget_match_driver() operates concurrently in another context accessing the same freed memory location through configfs interfaces. This fundamental timing issue creates a dangerous scenario where memory that has been deallocated is still being referenced, leading to a NULL pointer dereference at virtual address zero during kernel memory zeroing operations.
The technical implementation of this vulnerability stems from improper synchronization between the device controller's lifecycle management and driver matching operations within the USB gadget framework. When the system attempts to switch operating modes through workqueue execution contexts such as __dwc3_set_mode, the udc structure gets freed while other subsystem components like gadget_match_driver() continue to access its memory locations. The kernel crash trace demonstrates this issue clearly with the NULL pointer dereference occurring at __pi_strcmp function call within gadget_match_driver context, indicating that freed memory has been accessed and subsequently zeroed by the kernel's memory management subsystem. The stack trace reveals the execution flow moving from configfs_write_iter through usb_gadget_register_driver_owner to gadget_dev_desc_UDC_store, ultimately leading to the workqueue handler __dwc3_set_mode which calls dwc3_gadget_exit and triggers the memory deallocation.
The operational impact of this vulnerability extends beyond simple system crashes as it represents a potential security risk that could be exploited by malicious actors to achieve privilege escalation or denial of service conditions. Attackers could potentially leverage this race condition to cause system instability, particularly in embedded systems or devices running Linux kernels where USB gadget functionality is heavily utilized. The vulnerability affects the core USB gadget infrastructure and impacts any device implementing USB device controller drivers such as dwc3, making it a widespread concern across various hardware platforms. This type of use-after-free condition falls under CWE-416 which specifically addresses Use After Free vulnerabilities, and aligns with ATT&CK technique T1059.006 for kernel-mode rootkits that exploit memory corruption weaknesses in operating system components.
The fix implemented addresses the fundamental synchronization issue by introducing a proper reference counting mechanism within the USB gadget core framework. The solution involves creating a new usb_gadget_release() routine that ensures proper lifecycle management of udc structures throughout the gadget's operational period. When usb_add_gadget() registers a gadget, it now stores the gadget's release routine within the udc structure and maintains an active reference to prevent premature deallocation. This approach ensures that the udc structure remains allocated until all references are properly released, preventing the race condition between memory deallocation and concurrent access attempts. The fix essentially implements a proper resource management pattern that aligns with best practices in kernel development and prevents the scenario where freed memory continues to be accessed by concurrent operations, thereby resolving both the immediate crash condition and the underlying synchronization flaw that enables potential exploitation.