usb: fix UAF when probe runs concurrent to dyn ID removal
In the Linux kernel, the following vulnerability has been resolved: usb: fix UAF when probe runs concurrent to dyn ID removal Dynamic IDs are only guaranteed to be valid when usb_dynids_lock is held, as remove_id_store can free the node. Thus, make a copy in usb_probe_interface. Clarify the documentation that the id parameter is only valid during the probe. USB serial has the same pattern, but it does not need fixing as the IDs cannot be removed via sysfs.
CVE-2026-93117
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-93117
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "0c7a2b72746a96f999fd2728520d03d94879be69",
"lessThan": "9b82ddf76827e2a8ff033a8131ecf24f2d6cae26",
"versionType": "git"
},
{
"status": "affected",
"version": "0c7a2b72746a96f999fd2728520d03d94879be69",
"lessThan": "44904468e58d3dc3a0229782acbeb9677b060541",
"versionType": "git"
},
{
"status": "affected",
"version": "0c7a2b72746a96f999fd2728520d03d94879be69",
"lessThan": "64320c6e721bdec4c43a789c866c8a099dd0c843",
"versionType": "git"
},
{
"status": "affected",
"version": "0c7a2b72746a96f999fd2728520d03d94879be69",
"lessThan": "7e795801295c84a6bbc10a3e7a4c99c50bfe45ac",
"versionType": "git"
},
{
"status": "affected",
"version": "0c7a2b72746a96f999fd2728520d03d94879be69",
"lessThan": "e6a9c6b79b70046afdf5a1dbd03b1104536f30c0",
"versionType": "git"
},
{
"status": "affected",
"version": "0c7a2b72746a96f999fd2728520d03d94879be69",
"lessThan": "ef8154d8b52d60338c1fd8d793cd8e891c604c14",
"versionType": "git"
}
],
"programFiles": [
"drivers/usb/core/driver.c",
"include/linux/usb.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.33"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.33",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/usb/core/driver.c",
"include/linux/usb.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-93117
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #37842 · Revision 1
- Added to Heist Feed
- Publisher date