Cloudanix VulnDB

CVE-2026-89733

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in Linux kernel USB video gadget handling could let someone with local access crash the system or gain higher privileges.

Chainable
Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

In uvc_function_bind() error path and uvc_function_unbind(), usb_ep_free_request and kfree leave uvc->control_req and uvc->control_buf as dangling pointers, enabling use-after-free on subsequent accesses.

Why it matters to the business

Local attackers can trigger kernel memory corruption on Linux systems exposing USB gadget UVC functionality, risking crashes, data loss, or elevated privileges; low EPSS and no KEV status indicate limited observed exploitation 43 days post-publication.

How an attack unfolds

An attacker with local access loads the UVC gadget driver and forces error paths during bind or unbind operations to dereference freed pointers for memory corruption or escalation.

How to fix it

Apply upstream kernel patch that sets uvc->control_req to NULL after usb_ep_free_request and uvc->control_buf to NULL after kfree in both functions; rebuild and deploy updated kernel.

How to confirm the fix worked

Inspect kernel source for NULL assignments immediately following free operations in uvc_function_bind and uvc_function_unbind; test error injection paths to confirm no dangling references remain.

Typical attack path

  1. Obtain local user access on target Linux system
  2. Interact with or load usb gadget uvc driver
  3. Trigger error conditions in uvc_function_bind or uvc_function_unbind
  4. Leverage resulting UAF for kernel read/write or control flow hijack

How to detect it

Review kernel logs and dmesg for UVC UAF oops/panics or suspicious gadget bind/unbind failures; correlate with local process activity involving usb gadget drivers.

What your security team should do

  • Prioritize kernel updates for systems using USB gadget UVC
  • Audit and restrict local access to USB gadget interfaces where feasible
  • Monitor kernel logs for UVC-related faults as a temporary detection measure

The record

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() In uvc_function_bind() error path, we use usb_ep_free_request which uses uvc->control_req but does not set it to NULL afterwards. Thus, uvc->control_req is a dangling pointer causing a UAF. Also we do not set the uvc->control_buf pointer to NULL after freeing it, which is another dangling pointer. Fix it by setting uvc->control_req to NULL after we run usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the same for uvc_function_unbind().

Affected packages

Ecosystem Package Introduced Fixed