What is the CVSS score of EUVD-2026-55560?

EUVD-2026-55560 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-55560?

Most Linux systems face a privilege escalation risk from local users who can trigger a kernel race condition in the USB subsystem.. A patch is available.

How to fix or mitigate EUVD-2026-55560?

Within 24 hours, identify and document all Linux systems in your environment that run USB functionality, which typically includes most Linux deployments. Within 7 days, obtain vendor-released kernel patches through your Linux distribution channels and schedule maintenance windows for patch deployment. Within 30 days, complete kernel updates across all affected systems, prioritizing production infrastructure and systems with active user access, then validate system stability and normal operations post-update.

Linux Kernel EUVD-2026-55560

| CVE-2026-68374 HIGH

2026-08-10 Linux

GHSA-hh3m-2ww4-7gxq

Information Disclosure Linux Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition requires precise timing between USB reset and sysfs read, warranting AC:H; local low-privilege access confirmed prerequisite, scope unchanged within kernel boundary.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.3 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 02:58 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:03 cve.org

HIGH 7.8

CVE Published

Aug 10, 2026 - 12:03 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

usb: core: sysfs: add lock to bos_descriptors_read()

Add a lock to the function bos_descriptors_read().

This function accesses udev->bos, which could be simultaneously freed in usb_reset_and_verify_device(), a function that is commonly called in drivers all over the kernel.

AnalysisAI

Use-after-free race condition in Linux kernel USB core sysfs allows a local low-privileged user to trigger concurrent memory access on freed BOS descriptor data, potentially leading to kernel memory corruption, privilege escalation, or system crash. The vulnerability arises in bos_descriptors_read() within the USB sysfs subsystem, where udev->bos is accessed without a lock while usb_reset_and_verify_device() - called by numerous drivers across the kernel - can free that same memory simultaneously. No public exploit code exists and the vulnerability is not listed in CISA KEV; the EPSS score of 0.17% confirms low observed exploitation probability at time of analysis.

Technical ContextAI

The affected code resides in the Linux kernel's USB core sysfs layer (usb/core/sysfs.c). The bos_descriptors_read() function exposes USB Binary Object Store (BOS) descriptor data through the sysfs virtual filesystem. BOS descriptors describe USB device capabilities and are stored in the udev->bos structure. The vulnerability is a classic TOCTOU (time-of-check-time-of-use) race: bos_descriptors_read() dereferences udev->bos without holding any lock, while usb_reset_and_verify_device() - a widely called function in USB device drivers throughout the kernel - can concurrently free and reallocate that same structure. Although CWE is listed as N/A in available data, this maps functionally to CWE-416 (Use After Free) arising through CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization). CPE data (cpe:2.3:a:linux:linux:*) indicates all kernel versions prior to the stable fixes are affected.

RemediationAI

Upgrade to Linux kernel 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 or later, all of which add the missing lock in bos_descriptors_read() to prevent concurrent access during USB device resets. Upstream stable commits are available at https://git.kernel.org/stable/c/c07caee449c968842a350bfefa049889923b8240 (one fix branch), https://git.kernel.org/stable/c/217774e143d7b5a88739193284b6421be3978601, https://git.kernel.org/stable/c/ab82adf5e63b2d89ead7933ab753b9cedbe028e9, and https://git.kernel.org/stable/c/4e0197fbb0eec588795d5431716a244d9ac8fa93. For systems where immediate kernel upgrade is not feasible, restricting local user access to USB sysfs paths (e.g., via udev rules assigning restrictive permissions to BOS-related sysfs nodes, or removing USB sysfs access through namespace isolation in container environments) reduces the attack surface; note this may interfere with USB device management tools that rely on sysfs enumeration. Systems with no untrusted local shell access do not require emergency action but should be patched at next maintenance window.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-55560 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-55560

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code