Cloudanix VulnDB

CVE-2026-68370

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A timing flaw in the Linux kernel's USB gadget simulation code can let a local user interfere with internal operations and crash the entire system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition on a single shared usb_request structure in dummy_hcd allows concurrent dummy_queue() reuse before the completion callback returns, overwriting the req->complete function pointer via an in-bounds memcpy and causing an invalid indirect call and kernel fault in dummy_timer.

Why it matters to the business

Local attackers can trigger kernel crashes on systems exposing USB gadget functionality, leading to denial of service, system reboots, and potential loss of availability for affected devices or virtualized environments.

How an attack unfolds

An attacker with local access configures the dummy_hcd gadget and issues concurrent queue and dequeue/transfer operations from multiple CPUs; the race lets dummy_queue() overwrite the live completion pointer mid-invocation, resulting in a general protection fault when the clobbered pointer is called.

How to fix it

Apply the upstream kernel patch that introduces a fifo_req_busy flag set on FIFO fast-path entry and cleared only after the completion callback returns via a new dummy_giveback helper at all giveback sites.

How to confirm the fix worked

Inspect dummy_hcd.c for the fifo_req_busy bit implementation and replacement of the list_empty guard; confirm absence of the race by running the original syzkaller reproducer or equivalent concurrent gadget stress tests.

Typical attack path

  1. Obtain local user access on a Linux system using the dummy_hcd USB gadget driver
  2. Set up gadget configuration that exercises the emulated FIFO fast-path for small IN transfers
  3. Trigger concurrent calls to dummy_queue() while dummy_timer or nuke paths are executing giveback
  4. Cause the list_empty check to race with list_del_init, overwriting req->complete and inducing kernel fault

How to detect it

Search kernel logs and crash dumps for general protection faults or page faults originating in dummy_timer during USB gadget activity; correlate with concurrent gadget queue operations from user-space processes.

What your security team should do

  • Patch affected kernels promptly, especially on systems exposing USB gadget interfaces
  • Restrict local access and USB gadget configuration capabilities where possible
  • Monitor kernel logs for GPFs or oops mentioning dummy_timer or dummy_hcd
  • Consider disabling dummy_hcd in production configurations if not required

The record

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback dummy_hcd embeds a single shared usb_request (dum->fifo_req) that the "emulated single-request FIFO" fast-path in dummy_queue() reuses for small IN transfers: it copies the caller's request into it (req->req = *_req) and queues it, treating list_empty(&fifo_req.queue) as "the slot is free". The completion side (dummy_timer/transfer/nuke/dummy_dequeue) follows the standard pattern: list_del_init(&req->queue) unlinks the request, then the lock is dropped and usb_gadget_giveback_request() invokes req->complete(). But list_del_init() makes fifo_req.queue look empty *before* the completion callback returns, so a concurrent dummy_queue() on another CPU sees the slot as free, reuses fifo_req and runs req->req = *_req -- overwriting req->complete while dummy_timer is mid-calling it. The indirect call then jumps to a clobbered pointer, causing a general protection fault / page fault in dummy_timer (syzkaller extid faf3a6cf579fc65591ca). The clobbering write is an in-bounds memcpy on a live shared object, so KASAN cannot flag it. Add a fifo_req_busy bit covering the shared request's whole lifetime: set it in dummy_queue() when the FIFO fast-path takes fifo_req (making it the fast-path guard, replacing the list_empty(&fifo_req.queue) test), and clear it after the completion callback has returned, via a dummy_giveback() helper used at all four gadget-request giveback sites. The shared slot can no longer be reused until its completion callback has finished.

Affected packages

Ecosystem Package Introduced Fixed