CVE-2026-68367 - Vulnerability Details

- usb: gadget: f_tcm: synchronize delayed set_alt with teardown

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_tcm: synchronize delayed set_alt with teardown

The f_tcm set_alt() path defers endpoint setup to a work item and
completes the delayed status response from process context. The delayed
work uses f_tcm private state and may complete the setup request after
disconnect or function teardown has already moved on.

Cancel and drain the delayed set_alt work when the function is unbound or
freed. For disable paths, which are reached under the composite device
lock, use a small state machine and a non-sleeping cancellation path
instead of cancel_work_sync(). If the work is already running, mark it
cancelled and let the worker own the cleanup; otherwise tcm_disable() can
cancel the queued work and clean up immediately.

Also serialize the final delayed-status completion with the cancellation
check while holding the composite device lock. This prevents a disconnect
from clearing delayed_status while the worker is about to complete the
control request.

Validation reproduced this kernel report:
BUG: KASAN: slab-use-after-free in tcm_delayed_set_alt+0x6c/0xef0

Call Trace:
<TASK>
dump_stack_lvl+0x66/0xa0
print_report+0xce/0x630
? tcm_delayed_set_alt+0x6c/0xef0
? srso_alias_return_thunk+0x5/0xfbef5
? __virt_addr_valid+0x188/0x320
? tcm_delayed_set_alt+0x6c/0xef0
kasan_report+0xe0/0x110
? tcm_delayed_set_alt+0x6c/0xef0
tcm_delayed_set_alt+0x6c/0xef0
? __pfx_tcm_delayed_set_alt+0x10/0x10
? process_one_work+0x4cb/0xb90
? rcu_is_watching+0x20/0x50
? tcm_delayed_set_alt+0x9/0xef0
process_one_work+0x4d7/0xb90
? __pfx_process_one_work+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? __list_add_valid_or_report+0x37/0xf0
? __pfx_tcm_delayed_set_alt+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
worker_thread+0x2d8/0x570
? __pfx_worker_thread+0x10/0x10
kthread+0x1ad/0x1f0
? __pfx_kthread+0x10/0x10
ret_from_fork+0x3c9/0x540
? __pfx_ret_from_fork+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? __switch_to+0x2e9/0x730
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>

Allocated by task 544:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0x8f/0xa0
tcm_alloc+0x68/0x180
usb_get_function+0x36/0x60
config_usb_cfg_link+0x125/0x1b0
configfs_symlink+0x322/0x890
vfs_symlink+0xc2/0x270
filename_symlinkat+0x295/0x2f0
__x64_sys_symlinkat+0x62/0x90
do_syscall_64+0x115/0x6a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 661:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x43/0x70
kfree+0x2f9/0x530
config_usb_cfg_unlink+0x173/0x1e0
configfs_unlink+0x1fa/0x340
vfs_unlink+0x15c/0x510
filename_unlinkat+0x2ba/0x450
__x64_sys_unlinkat+0x63/0x90
do_syscall_64+0x115/0x6a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Published: 2026-08-10

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug is a use‑after‑free in the Linux kernel USB gadget driver f_tcm. A delayed work item configured for endpoint setup may execute after the gadget has been torn down. When that work accesses freed private state it corrupts kernel memory and can trigger a kernel panic or other stability issues. The flaw is limited to kernel space; no confirmed exploit exists.

Affected Systems

All Linux kernel builds that contain the f_tcm USB gadget driver and have not yet incorporated the synchronization and cancellation changes described in the patch. This includes every distribution kernel prior to the commit that ensures teardown and delayed work are coordinated.

Risk and Exploitability

The CVSS score of 4.1 indicates a low impact. The EPSS score is <1%, showing a very low likelihood of exploitation. The vulnerability is not in the CISA KEV catalog. Exploitation would require a race condition between a local attacker who can drive the USB gadget interface and the kernel's disconnect or teardown logic, which is difficult to trigger. While the risk is limited, early remediation is advised.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c52661d60f636d17e26ad834457db333bd1df494`	affected	< 8fb317058d165c88f3344f59439c14872c162b3c
`c52661d60f636d17e26ad834457db333bd1df494`	affected	< 90431d8523c0c1c9f8e3e3f0895727063f93da85
`c52661d60f636d17e26ad834457db333bd1df494`	affected	< ee07d09419f1c59c74f73107aa08444f2f2fc6c8
`c52661d60f636d17e26ad834457db333bd1df494`	affected	< 3118bb872c7dff653294f193d5328a476619e04d
`c52661d60f636d17e26ad834457db333bd1df494`	affected	< a6eb5a0ae7cd313cfd7df78decd8f43b64c68703
`c52661d60f636d17e26ad834457db333bd1df494`	affected	< f282242906c12fd476b86757afba51f211d4f959
`c52661d60f636d17e26ad834457db333bd1df494`	affected	< 4c6c6a5588b9a2f8437fb794e852d05fa60ebe53
`c52661d60f636d17e26ad834457db333bd1df494`	affected	< 79e2d75725c85607f8a9d87ae9cace62a19f767d

Linux

affected

Version	Status	Constraints
`3.5`	affected	—
`0`	unaffected	< 3.5
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.151`	unaffected	≤ 6.6.*
`6.12.103`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c52661d60f636d17e26ad834457db333bd1df494,3118bb872c7dff653294f193d5328a476619e04d)`	affected	code_commit	—
`[c52661d60f636d17e26ad834457db333bd1df494,a6eb5a0ae7cd313cfd7df78decd8f43b64c68703)`	affected	code_commit	—
`[c52661d60f636d17e26ad834457db333bd1df494,f282242906c12fd476b86757afba51f211d4f959)`	affected	code_commit	—
`[c52661d60f636d17e26ad834457db333bd1df494,4c6c6a5588b9a2f8437fb794e852d05fa60ebe53)`	affected	code_commit	—
`[c52661d60f636d17e26ad834457db333bd1df494,79e2d75725c85607f8a9d87ae9cace62a19f767d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.5`	affected	generic	—
`[0,3.5)`	unaffected	generic	—
`[6.6.151,6.7.0)`	unaffected	semver	—
`[6.12.103,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the f_tcm synchronization fix.
If upgrading is not feasible, unload or disable the f_tcm driver or any USB gadget functions that depend on it.
If a manual patch is required, apply the changes from the upstream kernel commit that cancels or drains the delayed set_alt work and serializes the final status completion while holding the composite device lock.

Generated by OpenCVE AI on August 13, 2026 at 06:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00184.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3118bb872c7dff653294f193d5328a476619e04d
https://git.kernel.org/stable/c/4c6c6a5588b9a2f8437fb794e852d05fa60ebe53
https://git.kernel.org/stable/c/79e2d75725c85607f8a9d87ae9cace62a19f767d
https://git.kernel.org/stable/c/8fb317058d165c88f3344f59439c14872c162b3c
https://git.kernel.org/stable/c/90431d8523c0c1c9f8e3e3f0895727063f93da85
https://git.kernel.org/stable/c/a6eb5a0ae7cd313cfd7df78decd8f43b64c68703
https://git.kernel.org/stable/c/ee07d09419f1c59c74f73107aa08444f2f2fc6c8
https://git.kernel.org/stable/c/f282242906c12fd476b86757afba51f211d4f959
https://nvd.nist.gov/vuln/detail/CVE-2026-68367
https://www.cve.org/CVERecord?id=CVE-2026-68367

History

Sun, 23 Aug 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/8fb317058d165c88f3344f59439c14872c162b3c https://git.kernel.org/stable/c/90431d8523c0c1c9f8e3e3f0895727063f93da85 https://git.kernel.org/stable/c/ee07d09419f1c59c74f73107aa08444f2f2fc6c8

Thu, 13 Aug 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68367 https://www.cve.org/CVERecord?id=CVE-2026-68367
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: synchronize delayed set_alt with teardown The f_tcm set_alt() path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses f_tcm private state and may complete the setup request after disconnect or function teardown has already moved on. Cancel and drain the delayed set_alt work when the function is unbound or freed. For disable paths, which are reached under the composite device lock, use a small state machine and a non-sleeping cancellation path instead of cancel_work_sync(). If the work is already running, mark it cancelled and let the worker own the cleanup; otherwise tcm_disable() can cancel the queued work and clean up immediately. Also serialize the final delayed-status completion with the cancellation check while holding the composite device lock. This prevents a disconnect from clearing delayed_status while the worker is about to complete the control request. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in tcm_delayed_set_alt+0x6c/0xef0 Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 ? tcm_delayed_set_alt+0x6c/0xef0 ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x188/0x320 ? tcm_delayed_set_alt+0x6c/0xef0 kasan_report+0xe0/0x110 ? tcm_delayed_set_alt+0x6c/0xef0 tcm_delayed_set_alt+0x6c/0xef0 ? __pfx_tcm_delayed_set_alt+0x10/0x10 ? process_one_work+0x4cb/0xb90 ? rcu_is_watching+0x20/0x50 ? tcm_delayed_set_alt+0x9/0xef0 process_one_work+0x4d7/0xb90 ? __pfx_process_one_work+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __list_add_valid_or_report+0x37/0xf0 ? __pfx_tcm_delayed_set_alt+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 worker_thread+0x2d8/0x570 ? __pfx_worker_thread+0x10/0x10 kthread+0x1ad/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3c9/0x540 ? __pfx_ret_from_fork+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __switch_to+0x2e9/0x730 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 544: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 tcm_alloc+0x68/0x180 usb_get_function+0x36/0x60 config_usb_cfg_link+0x125/0x1b0 configfs_symlink+0x322/0x890 vfs_symlink+0xc2/0x270 filename_symlinkat+0x295/0x2f0 __x64_sys_symlinkat+0x62/0x90 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 661: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kfree+0x2f9/0x530 config_usb_cfg_unlink+0x173/0x1e0 configfs_unlink+0x1fa/0x340 vfs_unlink+0x15c/0x510 filename_unlinkat+0x2ba/0x450 __x64_sys_unlinkat+0x63/0x90 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Title		usb: gadget: f_tcm: synchronize delayed set_alt with teardown
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3118bb872c7dff653294f193d5328a476619e04d https://git.kernel.org/stable/c/4c6c6a5588b9a2f8437fb794e852d05fa60ebe53 https://git.kernel.org/stable/c/79e2d75725c85607f8a9d87ae9cace62a19f767d https://git.kernel.org/stable/c/a6eb5a0ae7cd313cfd7df78decd8f43b64c68703 https://git.kernel.org/stable/c/f282242906c12fd476b86757afba51f211d4f959

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:03:44.600Z

Updated: 2026-08-23T12:46:18.779Z

Reserved: 2026-07-30T09:28:09.385Z

Link: CVE-2026-68367

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:20:29.353

Modified: 2026-08-23T13:16:36.390

Link: CVE-2026-68367

Redhat

Severity : Moderate

Publid Date: 2026-08-10T12:03:44Z

Links: CVE-2026-68367 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T06:30:05Z

Weaknesses

CWE-364
Signal Handler Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object