CVE-2026-68367 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_tcm: synchronize delayed set_alt with teardown
The f_tcm set_alt() path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses f_tcm private state and may complete the setup request after disconnect or function teardown has already moved on.
Cancel and drain the delayed set_alt work when the function is unbound or freed. For disable paths, which are reached under the composite device lock, use a small state machine and a non-sleeping cancellation path instead of cancel_work_sync(). If the work is already running, mark it cancelled and let the worker own the cleanup; otherwise tcm_disable() can cancel the queued work and clean up immediately.
Also serialize the final delayed-status completion with the cancellation check while holding the composite device lock. This prevents a disconnect from clearing delayed_status while the worker is about to complete the control request.
Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in tcm_delayed_set_alt+0x6c/0xef0
Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 ? tcm_delayed_set_alt+0x6c/0xef0 ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x188/0x320 ? tcm_delayed_set_alt+0x6c/0xef0 kasan_report+0xe0/0x110 ? tcm_delayed_set_alt+0x6c/0xef0 tcm_delayed_set_alt+0x6c/0xef0 ? __pfx_tcm_delayed_set_alt+0x10/0x10 ? process_one_work+0x4cb/0xb90 ? rcu_is_watching+0x20/0x50 ? tcm_delayed_set_alt+0x9/0xef0 process_one_work+0x4d7/0xb90 ? __pfx_process_one_work+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __list_add_valid_or_report+0x37/0xf0 ? __pfx_tcm_delayed_set_alt+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 worker_thread+0x2d8/0x570 ? __pfx_worker_thread+0x10/0x10 kthread+0x1ad/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3c9/0x540 ? __pfx_ret_from_fork+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __switch_to+0x2e9/0x730 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
Allocated by task 544: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 tcm_alloc+0x68/0x180 usb_get_function+0x36/0x60 config_usb_cfg_link+0x125/0x1b0 configfs_symlink+0x322/0x890 vfs_symlink+0xc2/0x270 filename_symlinkat+0x295/0x2f0 __x64_sys_symlinkat+0x62/0x90 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 661: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kfree+0x2f9/0x530 config_usb_cfg_unlink+0x173/0x1e0 configfs_unlink+0x1fa/0x340 vfs_unlink+0x15c/0x510 filename_unlinkat+0x2ba/0x450 __x64_sys_unlinkat+0x63/0x90 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability addressed in this Linux kernel update relates to a use-after-free condition within the usb gadget function controller module, specifically affecting the f_tcm (Target Core Module) driver. This flaw occurs during the handling of USB configuration changes when the set_alt() function is invoked, which defers endpoint setup operations to a work item scheduled for execution in process context. The delayed work mechanism creates a race condition where the worker thread may attempt to access memory that has already been freed during device disconnection or function teardown operations.
The technical root cause stems from improper synchronization between the deferred work execution and the lifecycle management of USB gadget functions. When a USB function is unbound or freed, the system must properly cancel any pending work items that reference the function's private state. Without proper cancellation and draining mechanisms, the delayed work can complete its execution after the memory associated with the function has been deallocated, resulting in a use-after-free scenario that can lead to kernel crashes or potentially exploitable conditions.
This vulnerability manifests as a KASAN (Kernel Address Sanitizer) detection of slab-use-after-free error during execution of tcm_delayed_set_alt function. The call trace shows the execution path leading to the invalid memory access, with the allocation occurring in tcm_alloc and the subsequent deallocation happening during configfs_unlink operations. The race condition is particularly dangerous because it can occur during device teardown when multiple threads are involved in cleanup operations, creating a window where memory management operations conflict with ongoing work item processing.
The fix implements a comprehensive approach to prevent this scenario by introducing proper work cancellation mechanisms that handle both normal and disable paths within the USB gadget framework. For standard unbinding scenarios, the solution cancels and drains delayed work items before function teardown begins. For disable paths that operate under the composite device lock, a state machine-based approach with non-sleeping cancellation is employed to avoid potential deadlocks while ensuring proper cleanup of resources.
The mitigation strategy addresses multiple aspects of the vulnerability including serialization of final delayed-status completions with cancellation checks while holding the composite device lock, preventing disconnect operations from clearing delayed_status while workers are about to complete control requests. This approach aligns with common security best practices for kernel memory management and race condition prevention. The fix directly corresponds to CWE-416 (Use After Free) and addresses ATT&CK techniques related to privilege escalation through kernel vulnerabilities. The solution ensures that all pending work items are properly cleaned up before function resources are released, preventing the conditions that lead to memory corruption during USB gadget operation and maintaining system stability under concurrent access scenarios.