CVE-2026-93117 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: usb: fix UAF when probe runs concurrent to dyn ID removal Dynamic IDs are only guaranteed to be valid when usb_dynids_lock is held, as remove_id_store can free the node. Thus, make a copy in usb_probe_interface. Clarify the documentation that the id parameter is only valid during the probe. USB serial has the same pattern, but it does not need fixing as the IDs cannot be removed via sysfs.
AZL-102279
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:AZL-102279
kernel
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 6.6.157.1-1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.6.157.1-1"
}
]
}
],
"package": {
"name": "kernel",
"purl": "pkg:rpm/azure-linux/kernel",
"ecosystem": "Azure Linux:3"
},
"database_specific": {
"source": "https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-102279.json"
}
}
]- Related CVEs
- CVE-2026-93117
Source reference:
/upstream
Publisher severity
No explicit severity was provided.
- Event
- #68385 · Revision 1
- Added to Heist Feed
- Publisher date