Cloudanix VulnDB

CVE-2026-93117

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A timing issue in how the system handles USB device identification could let an attacker on the machine corrupt memory and crash or take over the computer.

Chainable
Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in usb_probe_interface when a dynamic ID node is freed by remove_id_store without holding usb_dynids_lock during concurrent probe operations.

Why it matters to the business

Kernel memory corruption can lead to system crashes, denial of service, or potential privilege escalation on affected Linux systems, disrupting services and requiring emergency patching.

How an attack unfolds

An attacker with local access triggers concurrent USB device probing and dynamic ID removal via sysfs to race the free of an ID node against its use in the probe path, resulting in a dangling pointer dereference.

How to fix it

Update the Linux kernel to a version containing the fix that copies the dynamic ID inside usb_probe_interface before use and updates documentation to clarify ID validity scope.

How to confirm the fix worked

Verify the running kernel contains the commit that copies the ID in usb_probe_interface; inspect source for the usb_dynids_lock-protected copy and updated probe documentation.

Typical attack path

  1. Obtain local unprivileged access on a Linux system with USB support
  2. Trigger USB interface probing while concurrently writing to remove_id_store via sysfs
  3. Race the usb_dynids_lock to cause the ID node to be freed during usb_probe_interface
  4. Trigger dereference of the freed node to achieve memory corruption

How to detect it

Review kernel logs for use-after-free warnings or oops traces referencing usb_probe_interface or dynamic ID removal; correlate sysfs writes to remove_id_store with concurrent probe events.

What your security team should do

  • Apply the upstream kernel patch or distribution update containing the ID copy fix immediately
  • Audit custom kernels or USB-related modules for similar dynamic ID race patterns
  • Monitor for kernel oops or panic logs involving usb_probe_interface or usb_dynids

The record

In the Linux kernel, the following vulnerability has been resolved: usb: fix UAF when probe runs concurrent to dyn ID removal Dynamic IDs are only guaranteed to be valid when usb_dynids_lock is held, as remove_id_store can free the node. Thus, make a copy in usb_probe_interface. Clarify the documentation that the id parameter is only valid during the probe. USB serial has the same pattern, but it does not need fixing as the IDs cannot be removed via sysfs.

Affected packages

Ecosystem Package Introduced Fixed