Skip to main content

Linux Kernel EUVDEUVD-2026-48890

| CVE-2026-64346 HIGH
Use After Free (CWE-416)
2026-07-25 Linux GHSA-8737-2w76-fpfm
Denial Of Service Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition requires precise concurrent timing and DWC3 hardware, warranting AC:H; PR:L reflects configfs write access needed for the triggering path.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 03, 2026 - 16:12 vuln.today
CVSS changed
Sep 03, 2026 - 16:07 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: udc: Fix use-after-free in gadget_match_driver

The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usb_del_gadget() frees the udc memory (e.g., via mode-switch work) while gadget_match_driver() concurrently accesses the freed udc memory (e.g., via configfs), causing a Use-After-Free (UAF) that triggers a NULL pointer dereference when the freed memory is zeroed:

[39430.908615][ T1171] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [39430.911397][ T1171] pc : __pi_strcmp+0x20/0x140 [39430.911441][ T1171] lr : gadget_match_driver+0x34/0x60 ... [39430.911890][ T1171] usb_gadget_register_driver_owner+0x50/0xf8 [39430.911910][ T1171] gadget_dev_desc_UDC_store+0xf4/0x140 [39430.931308][ T1171] configfs_write_iter+0xec/0x134

[39430.957058][ T1171] Workqueue: events_freezable __dwc3_set_mode [39430.957287][ T1171] dwc3_gadget_exit+0x34/0x8c [39430.957304][ T1171] __dwc3_set_mode+0xc0/0x664

Fix this by ensuring the udc structure remains allocated until the gadget is released. To achieve this, introduce a new usb_gadget_release() routine to the core. When the gadget is added, usb_add_gadget() stores the gadget's release routine in the udc structure and takes a reference to the udc. When the gadget is released, usb_gadget_release() drops the reference to the udc and then calls the gadget's release routine.

AnalysisAI

Use-after-free in the Linux kernel USB gadget UDC subsystem exposes systems with DWC3-based USB controllers to a race condition between usb_del_gadget() and gadget_match_driver(), enabling a NULL pointer dereference that can crash the kernel or enable privilege escalation on unpatched systems. The flaw affects all major Linux stable branches from 5.15.x through 7.1.x prior to the patched releases, and is particularly relevant for embedded Linux, Android-based devices, and IoT hardware that use USB gadget/device mode. No public exploit has been identified at time of analysis, and EPSS remains at 0.21% (12th percentile), reflecting current low exploitation interest.

Technical ContextAI

The vulnerability resides in drivers/usb/gadget/udc/core.c within the Linux kernel's USB Device Controller driver core. CWE-416 (Use-After-Free) is the root cause: the udc and gadget structures have decoupled lifecycles, meaning usb_del_gadget() can free the udc structure via a workqueue path (__dwc3_set_mode → dwc3_gadget_exit) while gadget_match_driver() - invoked concurrently through a configfs write to the UDC attribute - still dereferences the now-freed and zeroed memory. The resulting NULL pointer is passed to __pi_strcmp(), producing the captured NULL pointer dereference at virtual address 0x0. The fix introduces usb_gadget_release() with reference counting on the udc structure so it cannot be freed until the gadget is fully released. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* spanning from the initial kernel commit (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2) through all stable branches prior to the patch series.

RemediationAI

The primary remediation is upgrading to a patched Linux kernel version for the relevant stable branch: 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, or 7.1.4 (or later), with upstream stable commits available at git.kernel.org/stable/c/ as referenced in the CVE. For systems where an immediate kernel upgrade is operationally infeasible, a targeted compensating control is to restrict write access to the configfs USB gadget UDC attribute (typically under /sys/kernel/config/usb_gadget/) to prevent untrusted users from triggering the gadget_match_driver path; however, this does not eliminate the kernel-internal race if the system's own privileged processes exercise the path. Alternatively, unloading or blacklisting the dwc3 and usb-gadget kernel modules on systems that do not require USB device mode eliminates the vulnerable code path entirely, at the cost of disabling all USB OTG/peripheral functionality on the affected hardware.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

EUVD-2026-48890 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy