Към съдържанието
Търсене

CVE-2026-68367: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: synchronize delayed set_alt with teardown The f_tcm set_alt() path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses f_tcm private state and may complete the setup request after disconnect or function teardown has already moved on. Cancel and drain the delayed set_alt work when the function is unbound or freed. For disable paths, which are reached under the composite device lock, use a small state machine and a non-sleeping cancellation path instead of cancel_work_sync(). If the work is already running, mark it cancelled and let the worker own the cleanup; otherwise tcm_disable() can cancel the queued work and clean up immediately. Also serialize the final delayed-status completion with the cancellation check while holding the composite device lock. This prevents a disconnect from clearing delayed_status while the worker is about to complete the control request. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in tcm_delayed_set_alt+0x6c/0xef0 Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 ? tcm_delayed_set_alt+0x6c/0xef0 ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x188/0x320 ? tcm_delayed_set_alt+0x6c/0xef0 kasan_report+0xe0/0x110 ? tcm_delayed_set_alt+0x6c/0xef0 tcm_delayed_set_alt+0x6c/0xef0 ? __pfx_tcm_delayed_set_alt+0x10/0x10 ? process_one_work+0x4cb/0xb90 ? rcu_is_watching+0x20/0x50 ? tcm_delayed_set_alt+0x9/0xef0 process_one_work+0x4d7/0xb90 ? __pfx_process_one_work+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __list_add_valid_or_report+0x37/0xf0 ? __pfx_tcm_delayed_set_alt+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 worker_thread+0x2d8/0x570 ? __pfx_worker_thread+0x10/0x10 kthread+0x1ad/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3c9/0x540 ? __pfx_ret_from_fork+0x10/0x10 ? srso_alias_return_thu

    Засегнати продукти

    • Linux Linux: c52661d60f636d17e26ad834457db333bd1df494 преди 8fb317058d165c88f3344f59439c14872c162b3c; c52661d60f636d17e26ad834457db333bd1df494 преди 90431d8523c0c1c9f8e3e3f0895727063f93da85; c52661d60f636d17e26ad834457db333bd1df494 преди ee07d09419f1c59c74f73107aa08444f2f2fc6c8; c52661d60f636d17e26ad834457db333bd1df494 преди 3118bb872c7dff653294f193d5328a476619e04d; c52661d60f636d17e26ad834457db333bd1df494 преди a6eb5a0ae7cd313cfd7df78decd8f43b64c68703; c52661d60f636d17e26ad834457db333bd1df494 преди f282242906c12fd476b86757afba51f211d4f959; c52661d60f636d17e26ad834457db333bd1df494 преди 4c6c6a5588b9a2f8437fb794e852d05fa60ebe53; c52661d60f636d17e26ad834457db333bd1df494 преди 79e2d75725c85607f8a9d87ae9cace62a19f767d
    • Linux Linux: 3.5; преди 3.5; 5.10.266 до 5.10.*; 5.15.217 до 5.15.*; 6.1.184 до 6.1.*; 6.6.151 до 6.6.*; 6.12.103 до 6.12.*; 6.18.42 до 6.18.*; 7.1.6 до 7.1.*; от 7.2 нататък

    История

    • 10 август 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-68367: Linux | freedomonline.bg