Cloudanix VulnDB

CVE-2026-68367

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in how the Linux kernel handles certain USB device connections could let an attacker crash the system or take control of it.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the f_tcm USB gadget driver where a delayed work item (tcm_delayed_set_alt) may access private state after function teardown or disconnect has freed the associated memory, resulting in slab-use-after-free.

Why it matters to the business

Kernel crashes or potential local privilege escalation on systems exposing USB gadget functionality, leading to device downtime or full system compromise in embedded, server, or IoT environments.

How an attack unfolds

An attacker with local or physical access repeatedly connects and disconnects a USB gadget device to race the delayed set_alt work item against configfs unlink paths, causing the worker to execute after the f_tcm structure has been freed.

How to fix it

Apply the upstream fix that introduces proper cancellation of the delayed set_alt work item using a state machine and non-sleeping cancel paths during function unbind and disable; rebuild and deploy the patched kernel.

How to confirm the fix worked

Confirm the presence of the synchronization changes in f_tcm.c around set_alt, disable, and unbind paths; reproduce the original KASAN report under USB connect/disconnect stress to verify absence of use-after-free.

Typical attack path

  1. Trigger USB gadget function binding via configfs symlink
  2. Rapidly perform unlink or disconnect operations under load
  3. Force the delayed work item to run after kfree of the private state
  4. Trigger slab-use-after-free during tcm_delayed_set_alt execution

How to detect it

Search kernel logs for KASAN reports mentioning tcm_delayed_set_alt, slab-use-after-free, or worker thread crashes during USB gadget teardown; inspect dmesg and audit logs for rapid configfs symlink/unlink sequences around USB gadget functions.

What your security team should do

  • Prioritize kernel updates on any systems exposing USB gadget/USB OTG functionality
  • Audit configfs USB gadget configurations for unnecessary exposure
  • Monitor for kernel oops or KASAN reports related to tcm_delayed_set_alt

The record

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: synchronize delayed set_alt with teardown The f_tcm set_alt() path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses f_tcm private state and may complete the setup request after disconnect or function teardown has already moved on. Cancel and drain the delayed set_alt work when the function is unbound or freed. For disable paths, which are reached under the composite device lock, use a small state machine and a non-sleeping cancellation path instead of cancel_work_sync(). If the work is already running, mark it cancelled and let the worker own the cleanup; otherwise tcm_disable() can cancel the queued work and clean up immediately. Also serialize the final delayed-status completion with the cancellation check while holding the composite device lock. This prevents a disconnect from clearing delayed_status while the worker is about to complete the control request. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in tcm_delayed_set_alt+0x6c/0xef0 Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 ? tcm_delayed_set_alt+0x6c/0xef0 ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x188/0x320 ? tcm_delayed_set_alt+0x6c/0xef0 kasan_report+0xe0/0x110 ? tcm_delayed_set_alt+0x6c/0xef0 tcm_delayed_set_alt+0x6c/0xef0 ? __pfx_tcm_delayed_set_alt+0x10/0x10 ? process_one_work+0x4cb/0xb90 ? rcu_is_watching+0x20/0x50 ? tcm_delayed_set_alt+0x9/0xef0 process_one_work+0x4d7/0xb90 ? __pfx_process_one_work+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __list_add_valid_or_report+0x37/0xf0 ? __pfx_tcm_delayed_set_alt+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 worker_thread+0x2d8/0x570 ? __pfx_worker_thread+0x10/0x10 kthread+0x1ad/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3c9/0x540 ? __pfx_ret_from_fork+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __switch_to+0x2e9/0x730 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 544: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 tcm_alloc+0x68/0x180 usb_get_function+0x36/0x60 config_usb_cfg_link+0x125/0x1b0 configfs_symlink+0x322/0x890 vfs_symlink+0xc2/0x270 filename_symlinkat+0x295/0x2f0 __x64_sys_symlinkat+0x62/0x90 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 661: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kfree+0x2f9/0x530 config_usb_cfg_unlink+0x173/0x1e0 configfs_unlink+0x1fa/0x340 vfs_unlink+0x15c/0x510 filename_unlinkat+0x2ba/0x450 __x64_sys_unlinkat+0x63/0x90 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Affected packages

Ecosystem Package Introduced Fixed