CVE-2026-64346

What it actually does

This is a Linux kernel race-condition use-after-free in the USB gadget UDC lifecycle. The UDC management structure can be freed by usb_del_gadget(), such as during USB controller mode-switch work, while gadget_match_driver() concurrently dereferences it through configfs-driven gadget registration. In observed crashes, the freed memory is zeroed and the kernel hits a NULL pointer dereference in __pi_strcmp(), but the underlying bug is stale kernel memory access. Practical impact is most likely local kernel denial of service through an oops/panic on systems exposing USB gadget configuration paths; broader memory-corruption impact is theoretically possible but no public exploit maturity is currently reported.

Why it matters to the business

Systems that use Linux USB gadget functionality, common in embedded devices, appliances, development boards, phones, IoT devices, and USB device-mode products, may be crashed by a local or otherwise privileged actor able to manipulate gadget configuration while USB mode changes occur. This can interrupt device availability, cause service outages, require manual recovery, and reduce reliability of products that depend on USB device-mode behavior. The vulnerability is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS, and has no reported exploit maturity, so it is generally a patch-management priority rather than an emergency internet-scale exploitation event.

How an attack unfolds

An attacker first needs access that allows interaction with Linux USB gadget configuration, typically write access to configfs entries under the USB gadget subsystem or equivalent local control over gadget binding and UDC selection. The attacker then repeatedly triggers gadget driver matching or registration operations while also causing USB controller mode transitions that remove or reconfigure the gadget. If the timing window is hit, usb_del_gadget() frees the UDC structure while gadget_match_driver() is still using it. The stale dereference can cause a kernel NULL pointer dereference and crash, producing stack traces involving gadget_match_driver(), gadget_dev_desc_UDC_store(), configfs_write_iter(), __dwc3_set_mode(), and dwc3_gadget_exit(). No named threat actors or in-the-wild exploitation have been reported in the supplied data.

How to fix it

Upgrade to a Linux kernel build that includes the upstream fix for the USB gadget UDC lifecycle race. Because no exact affected products or fixed package versions were supplied, rely on the relevant distribution, vendor, device manufacturer, or kernel stable-branch advisory and confirm the patch that keeps the UDC structure referenced until the gadget release path completes, including the usb_gadget_release() lifecycle change. For systems that cannot be patched immediately, reduce exposure by disabling unused USB gadget/device-mode functionality, restricting access to configfs, preventing untrusted users or containers from writing to USB gadget configuration paths, disabling unnecessary DWC3/UDC drivers, and limiting physical or management paths that can trigger USB role switching. Mitigations should be treated as risk reduction only; the correct fix is a patched kernel.

How to confirm the fix worked

Confirm remediation by verifying the running kernel package or firmware build contains the vendor backport for this USB gadget UDC use-after-free fix, not merely by checking an upstream version string. On source-based or custom kernels, confirm the USB gadget core includes the release-path reference handling for UDC lifetime management, including usb_gadget_release() behavior. Validate exposure by checking whether CONFIG_USB_GADGET, configfs USB gadget support, and UDC/DWC3 drivers are enabled and whether /sys/kernel/config/usb_gadget is present and writable. After patching, exercise normal USB gadget bind, unbind, and role-switch workflows and confirm no kernel oops or stack traces referencing gadget_match_driver, gadget_dev_desc_UDC_store, or __dwc3_set_mode occur.

Typical attack path

1. Gain local, privileged, or constrained administrative access capable of writing to Linux USB gadget configfs controls.
2. Identify that USB gadget/device-mode support is enabled and that a UDC is available.
3. Create or manipulate a USB gadget configuration and bind/unbind it through the UDC configfs interface.
4. Concurrently trigger USB controller role or mode changes, such as transitions handled by DWC3 mode-switch work.
5. Repeat the race until gadget_match_driver() accesses a UDC structure that has already been freed by usb_del_gadget().
6. Cause a kernel oops, NULL pointer dereference, or system panic, resulting in denial of service.

How to detect it

Look for evidence of kernel crashes, oops reports, panic logs, or repeated USB gadget reconfiguration activity. Relevant log sources include dmesg, journalctl -k, /var/log/kern.log, /var/log/messages, pstore/ramoops, kdump/vmcore analysis, crash dump systems, EDR telemetry with kernel panic capture, and embedded device diagnostic logs. Search for stack traces containing gadget_match_driver(), gadget_dev_desc_UDC_store(), configfs_write_iter(), __dwc3_set_mode(), dwc3_gadget_exit(), usb_gadget_register_driver_owner(), or NULL pointer dereferences around USB gadget operations. Also review audit logs or command history for writes to /sys/kernel/config/usb_gadget/*/UDC, repeated gadget bind/unbind operations, or unusual role-switch activity shortly before a crash. Absence of these artifacts does not prove non-exploitation, because a successful denial-of-service may leave limited logs if storage was not flushed before panic.

• gadget_match_driver
• gadget_dev_desc_UDC_store
• usb_gadget_register_driver_owner
• configfs_write_iter
• __dwc3_set_mode
• dwc3_gadget_exit
• Unable to handle kernel NULL pointer dereference
• Workqueue: events_freezable __dwc3_set_mode
• /sys/kernel/config/usb_gadget
• /sys/kernel/config/usb_gadget/*/UDC
• pc : __pi_strcmp
• lr : gadget_match_driver

What your security team should do

• Inventory Linux systems, appliances, embedded devices, and custom kernels that enable USB gadget/device-mode functionality.
• Prioritize patching systems where local users, containers, management agents, or exposed interfaces can write to USB gadget configfs controls.
• Obtain fixed kernel or firmware builds from the relevant OS, distribution, SoC, appliance, or device vendor and validate that the UDC lifetime patch is included.
• Restrict write access to /sys/kernel/config/usb_gadget and avoid granting untrusted workloads elevated privileges that expose configfs or USB controller controls.
• Disable USB gadget, UDC, or DWC3 role-switch functionality where it is not required.
• Add monitoring for kernel oops/panic traces containing USB gadget lifecycle functions so exploitation attempts and instability are visible.
• For embedded products, include USB gadget bind/unbind and role-switch race tests in regression testing before release.