CVE-2026-68374 (GCVE-0-2026-68374)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:03 – Updated: 2026-08-18 06:55
VLAI
Title
usb: core: sysfs: add lock to bos_descriptors_read()
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: core: sysfs: add lock to bos_descriptors_read() Add a lock to the function bos_descriptors_read(). This function accesses udev->bos, which could be simultaneously freed in usb_reset_and_verify_device(), a function that is commonly called in drivers all over the kernel.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 , < c07caee449c968842a350bfefa049889923b8240 (git)
Affected: 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 , < 217774e143d7b5a88739193284b6421be3978601 (git)
Affected: 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 , < ab82adf5e63b2d89ead7933ab753b9cedbe028e9 (git)
Affected: 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 , < 4e0197fbb0eec588795d5431716a244d9ac8fa93 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/core/sysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c07caee449c968842a350bfefa049889923b8240",
              "status": "affected",
              "version": "12fc84e8c4288cc8ed5f14a35e077130c2cfece2",
              "versionType": "git"
            },
            {
              "lessThan": "217774e143d7b5a88739193284b6421be3978601",
              "status": "affected",
              "version": "12fc84e8c4288cc8ed5f14a35e077130c2cfece2",
              "versionType": "git"
            },
            {
              "lessThan": "ab82adf5e63b2d89ead7933ab753b9cedbe028e9",
              "status": "affected",
              "version": "12fc84e8c4288cc8ed5f14a35e077130c2cfece2",
              "versionType": "git"
            },
            {
              "lessThan": "4e0197fbb0eec588795d5431716a244d9ac8fa93",
              "status": "affected",
              "version": "12fc84e8c4288cc8ed5f14a35e077130c2cfece2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/core/sysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: sysfs: add lock to bos_descriptors_read()\n\nAdd a lock to the function bos_descriptors_read().\n\nThis function accesses udev-\u003ebos, which could be simultaneously freed in\nusb_reset_and_verify_device(), a function that is commonly called in\ndrivers all over the kernel."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached by a local read() on the world-readable sysfs attribute /sys/bus/usb/devices/*/bos_descriptors, and the racing reset is driven locally via the usbfs USBDEVFS_RESET ioctl or driver error recovery. No network or physical access to the bug itself is required.\nAC:L - The attacker controls both sides of the race: a loop of read() calls on the sysfs file plus repeated USBDEVFS_RESET ioctls (or induced driver resets), and the reset window spanning re-enumeration is milliseconds wide, so the race can be won reliably with retries.\nPR:L - The bos_descriptors binary attribute is BIN_ATTR_RO (0444), readable by any unprivileged local user; the device-reset side is available to the seat user through usbfs uaccess/plugdev ACLs on desktops, kiosks and containers with USB device access.\nUI:N - No victim action is needed; the attacker performs both the sysfs read and the device reset entirely on its own, with no cooperation from another user or process.\nS:U - The use-after-free corrupts and discloses kernel heap memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The memcpy reads from an already-kfree()d BOS buffer and copies up to 65535 bytes straight to userspace, and because wTotalLength itself is read from the reclaimed object the read can extend past the original allocation, leaking arbitrary reallocated kernel heap contents.\nI:H - This is a use-after-free on a kmalloc\u0027d object whose contents the attacker can influence by heap spraying into the freed slot; such UAFs on hot kernel slabs are a standard primitive for corrupting adjacent/reallocated kernel state and hijacking control flow.\nA:H - Dereferencing the freed usb_host_bos and copying a length derived from reclaimed memory readily runs off the end of the slab into unmapped or poisoned pages, producing a KASAN report, oops or panic that takes the machine down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T06:55:59.462Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c07caee449c968842a350bfefa049889923b8240"
        },
        {
          "url": "https://git.kernel.org/stable/c/217774e143d7b5a88739193284b6421be3978601"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab82adf5e63b2d89ead7933ab753b9cedbe028e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e0197fbb0eec588795d5431716a244d9ac8fa93"
        }
      ],
      "title": "usb: core: sysfs: add lock to bos_descriptors_read()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68374",
    "datePublished": "2026-08-10T12:03:52.701Z",
    "dateReserved": "2026-07-30T09:28:09.386Z",
    "dateUpdated": "2026-08-18T06:55:59.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68374",
      "date": "2026-08-20",
      "epss": "0.00128",
      "percentile": "0.02935"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68374\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:30.313\",\"lastModified\":\"2026-08-18T07:16:51.780\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: core: sysfs: add lock to bos_descriptors_read()\\n\\nAdd a lock to the function bos_descriptors_read().\\n\\nThis function accesses udev-\u003ebos, which could be simultaneously freed in\\nusb_reset_and_verify_device(), a function that is commonly called in\\ndrivers all over the kernel.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/core/sysfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"12fc84e8c4288cc8ed5f14a35e077130c2cfece2\",\"lessThan\":\"c07caee449c968842a350bfefa049889923b8240\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12fc84e8c4288cc8ed5f14a35e077130c2cfece2\",\"lessThan\":\"217774e143d7b5a88739193284b6421be3978601\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12fc84e8c4288cc8ed5f14a35e077130c2cfece2\",\"lessThan\":\"ab82adf5e63b2d89ead7933ab753b9cedbe028e9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12fc84e8c4288cc8ed5f14a35e077130c2cfece2\",\"lessThan\":\"4e0197fbb0eec588795d5431716a244d9ac8fa93\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/core/sysfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/217774e143d7b5a88739193284b6421be3978601\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4e0197fbb0eec588795d5431716a244d9ac8fa93\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ab82adf5e63b2d89ead7933ab753b9cedbe028e9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c07caee449c968842a350bfefa049889923b8240\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T23:27:43+00:00",
      "cve": "CVE-2026-68374",
      "id": "CVE-2026-68374",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: core: sysfs: add lock to bos_descriptors_read()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68374.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.