Cloudanix VulnDB

CVE-2026-68374

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A Linux kernel flaw in USB handling could let someone with access to the computer crash it or take control by exploiting a timing issue with device resets.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in Linux kernel USB core allowing concurrent access to udev->bos in bos_descriptors_read() while usb_reset_and_verify_device() frees the structure, resulting in use-after-free.

Why it matters to the business

Kernel instability, potential crashes, memory corruption, or local privilege escalation on Linux systems handling USB devices, disrupting operations and requiring urgent patching.

How an attack unfolds

Local attacker triggers USB device resets commonly performed by kernel drivers while simultaneously reading BOS descriptors through sysfs, exploiting the unlocked concurrent free and access to achieve use-after-free for code execution or denial of service.

How to fix it

Apply the upstream kernel patch adding locking to bos_descriptors_read(); upgrade to a patched kernel release once available.

How to confirm the fix worked

Confirm the lock is present in bos_descriptors_read() source, recompile and boot test kernels, and verify no concurrent free/access under USB reset workloads.

Typical attack path

  1. Obtain local user access on the target Linux system
  2. Initiate USB device interactions that invoke usb_reset_and_verify_device()
  3. Concurrently access BOS descriptors via sysfs to trigger the race
  4. Leverage resulting use-after-free for memory corruption or privilege escalation

How to detect it

Review kernel logs for USB reset and sysfs BOS access patterns around crashes; examine for use-after-free signatures in oops reports or memory dumps.

What your security team should do

  • Prioritize kernel updates for all affected Linux distributions
  • Limit untrusted local USB device access via policy or hardware controls
  • Monitor kernel mailing lists for the final fixed version release

The record

In the Linux kernel, the following vulnerability has been resolved: usb: core: sysfs: add lock to bos_descriptors_read() Add a lock to the function bos_descriptors_read(). This function accesses udev->bos, which could be simultaneously freed in usb_reset_and_verify_device(), a function that is commonly called in drivers all over the kernel.

Affected packages

Ecosystem Package Introduced Fixed