CVE-2026-68374 PUBLISHED

usb: core: sysfs: add lock to bos_descriptors_read()

Assigner: Linux
Reserved: 30.07.2026 Published: 10.08.2026 Updated: 10.08.2026

In the Linux kernel, the following vulnerability has been resolved:

usb: core: sysfs: add lock to bos_descriptors_read()

Add a lock to the function bos_descriptors_read().

This function accesses udev->bos, which could be simultaneously freed in usb_reset_and_verify_device(), a function that is commonly called in drivers all over the kernel.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to c07caee449c968842a350bfefa049889923b8240 (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 217774e143d7b5a88739193284b6421be3978601 (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to ab82adf5e63b2d89ead7933ab753b9cedbe028e9 (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 4e0197fbb0eec588795d5431716a244d9ac8fa93 (excl.)
  • affected from 0 to 6.12.101 (excl.)
  • affected from 0 to 6.18.42 (excl.)
  • affected from 0 to 7.1.6 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • unaffected from 6.12.101 to 6.12.* (incl.)
  • unaffected from 6.18.42 to 6.18.* (incl.)
  • unaffected from 7.1.6 to 7.1.* (incl.)
  • unaffected from 7.2-rc5 to * (incl.)

References