EUVD-2026-76645
GHSA-p2g2-5xg5-fj3w
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access required on gadget-mode device (AV:L); triggering bind error path or unbind race is non-trivial (AC:H); low-privilege local user can interact with gadget configfs (PR:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
In uvc_function_bind() error path, we use usb_ep_free_request which uses uvc->control_req but does not set it to NULL afterwards. Thus, uvc->control_req is a dangling pointer causing a UAF. Also we do not set the uvc->control_buf pointer to NULL after freeing it, which is another dangling pointer. Fix it by setting uvc->control_req to NULL after we run usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the same for uvc_function_unbind().
AnalysisAI
Dangling pointer use-after-free vulnerabilities in the Linux kernel USB gadget UVC (USB Video Class) driver allow a local attacker with low privileges to exploit freed memory in the uvc_function_bind() error path and uvc_function_unbind() teardown routine. The driver fails to NULL uvc->control_req after usb_ep_free_request() and uvc->control_buf after kfree(), leaving stale pointers that can be dereferenced in subsequent operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target system must be a Linux device configured to operate as a USB gadget (i.e., a USB peripheral/device, not a USB host - this is a gadget-side driver), (2) the UVC (USB Video Class) function must be enabled on that gadget - loading the usb_f_uvc kernel module and configuring a UVC function in configfs, (3) the attacker must have local access sufficient to trigger a bind/unbind cycle or induce a bind error, which requires at minimum PR:L access, (4) for the race-condition variant in uvc_function_unbind(), concurrent execution during teardown is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate-low despite the 7.8 CVSS base score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched stable kernel release: 6.12.109, 6.18.50, or 7.2.4, or apply the mainline fix from 7.3-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory systems running the Linux kernel with USB gadget UVC driver enabled (check for uvc_gadget or uvc_function kernel modules) and assess their criticality to operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today