CVE-2026-89733 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
In uvc_function_bind() error path, we use usb_ep_free_request which uses uvc->control_req but does not set it to NULL afterwards. Thus, uvc->control_req is a dangling pointer causing a UAF. Also we do not set the uvc->control_buf pointer to NULL after freeing it, which is another dangling pointer. Fix it by setting uvc->control_req to NULL after we run usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the same for uvc_function_unbind().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/11/2026
The Linux kernel's USB gadget subsystem contains a critical memory management flaw within the Video Class (UVC) function implementation, specifically affecting the initialization and cleanup routines known as uvc_function_bind and uvc_function_unbind. This vulnerability arises from improper pointer handling during error recovery paths in the binding process and during unbinding operations. When the system attempts to allocate resources for USB endpoints or buffers, it may encounter failures that trigger an early exit from these functions. In such scenarios, the code invokes cleanup routines like usb_ep_free_request and kfree to release previously allocated memory structures. However, a significant oversight exists in this process where the pointers referencing these freed resources are not nullified after deallocation occurs.
The technical root cause of this vulnerability lies in the failure to set uvc->control_req to NULL immediately following the call to usb_ep_free_request within an error path in uvc_function_bind. Similarly, the pointer uvc->control_buf is released via kfree but remains pointing to the now-invalid memory address without being reset to a null value. This behavior creates dangling pointers that retain references to deallocated kernel memory regions. If subsequent code paths attempt to access these pointers under certain conditions or if they are passed to other functions expecting valid allocations, the system may interpret stale data as legitimate objects. In uvc_function_unbind, which handles resource teardown when a gadget is disconnected or disabled, similar logic errors persist where freed resources leave behind invalid references that can lead to inconsistent state management within the kernel's USB subsystem.
The operational impact of this vulnerability centers on Use-After-Free (UAF) conditions and potential memory corruption scenarios. An attacker who can trigger specific error paths during device binding or unbinding operations may exploit these dangling pointers to read from or write to arbitrary kernel memory locations. This capability allows for information disclosure, where sensitive data stored in the freed memory regions could be leaked to user space through subsequent allocations that reuse those addresses. Furthermore, controlled writes into these memory areas can lead to privilege escalation by overwriting critical function pointers or control structures within the kernel. The instability introduced by accessing invalid memory often results in system crashes, leading to denial of service conditions for systems relying on USB gadget functionality, particularly in embedded devices and industrial controllers that utilize Linux-based operating systems with UVC capabilities enabled.
From a classification perspective, this issue aligns closely with CWE-416, which describes Use After Free vulnerabilities resulting from improper resource management practices. The failure to nullify pointers after deallocation is a classic example of insufficient cleanup procedures that leave the system in an unsafe state. In terms of attack vectors and techniques, this vulnerability facilitates exploitation patterns associated with ATT&CK technique T1059, specifically command execution or privilege escalation via memory corruption mechanisms. It also relates to data exfiltration methods where stale memory contents are accessed before being overwritten by new allocations, enabling unauthorized information retrieval from the kernel space.
Mitigation strategies primarily involve applying vendor-provided patches that update the Linux kernel source code to enforce strict pointer hygiene during resource lifecycle management. Developers must ensure that every call to free functions such as kfree or usb_ep_free_request is immediately followed by setting the corresponding pointers to NULL. This practice prevents accidental dereferencing of freed memory and ensures that any subsequent checks for nullity correctly identify invalid states rather than potentially dangerous dangling references. System administrators should prioritize updating their kernel versions to include these fixes, especially in environments where USB gadget functionality is exposed to untrusted networks or physical access points. Regular security audits focusing on error handling paths in device driver code can further reduce the risk of similar vulnerabilities by identifying patterns where resource cleanup procedures are incomplete or inconsistent across different subsystems within the operating system core.