{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68370","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.386Z","datePublished":"2026-08-10T12:03:48.320Z","dateUpdated":"2026-08-19T16:34:31.156Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-19T16:34:31.156Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: dummy_hcd: prevent fifo_req reuse during giveback\n\ndummy_hcd embeds a single shared usb_request (dum->fifo_req) that the\n\"emulated single-request FIFO\" fast-path in dummy_queue() reuses for\nsmall IN transfers: it copies the caller's request into it\n(req->req = *_req) and queues it, treating list_empty(&fifo_req.queue)\nas \"the slot is free\".\n\nThe completion side (dummy_timer/transfer/nuke/dummy_dequeue) follows\nthe standard pattern: list_del_init(&req->queue) unlinks the request,\nthen the lock is dropped and usb_gadget_giveback_request() invokes\nreq->complete().  But list_del_init() makes fifo_req.queue look empty\n*before* the completion callback returns, so a concurrent dummy_queue()\non another CPU sees the slot as free, reuses fifo_req and runs\nreq->req = *_req -- overwriting req->complete while dummy_timer is\nmid-calling it.  The indirect call then jumps to a clobbered pointer,\ncausing a general protection fault / page fault in dummy_timer\n(syzkaller extid faf3a6cf579fc65591ca).  The clobbering write is an\nin-bounds memcpy on a live shared object, so KASAN cannot flag it.\n\nAdd a fifo_req_busy bit covering the shared request's whole lifetime:\nset it in dummy_queue() when the FIFO fast-path takes fifo_req (making\nit the fast-path guard, replacing the list_empty(&fifo_req.queue)\ntest), and clear it after the completion callback has returned, via a\ndummy_giveback() helper used at all four gadget-request giveback\nsites.  The shared slot can no longer be reused until its completion\ncallback has finished."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - dummy_hcd is a purely virtual UDC/HCD pair with no physical port; both sides of the race are driven locally — gadget-side `usb_ep_queue()` via raw-gadget ioctls, gadgetfs/functionfs endpoint writes or configfs function traffic, and the host side by the in-software `dummy_timer`/URB path. No cable, hardware, or network access is involved, matching the AV:L used for other dummy_hcd/gadget bugs.\nAC:L - The attacker controls both sides of the race: it queues small IN requests on one CPU in a tight loop while the periodic 1 ms `dummy_timer` frame processing performs giveback on another, and the fast-path guard (`list_empty(&fifo_req.queue)`) is cleared before the callback returns, so the window is entered on essentially every iteration and can be retried indefinitely.\nPR:L - No capability check exists anywhere on the path — `dummy_queue()` and the giveback sites perform none; reachability is gated only by node/mount permissions on /dev/raw-gadget, gadgetfs or the gadget configfs/functionfs tree, which on Android and embedded/industrial systems are routinely delegated to non-root system accounts, so basic local access suffices.\nUI:N - The attacker performs every step itself — enabling the gadget, queueing the IN transfers, and letting the emulated frame timer run — with no action required from any other user or victim.\nS:U - The corrupted object and the resulting control-flow hijack are entirely within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The in-flight copy overwrites `fifo_req.req.buf`, `length`, `actual` and `context` of the live shared request, so the completion path and the host-side `transfer()` memcpy operate with mismatched buffer/length/context pairs, letting an attacker steer reads out of unintended kernel memory and surface them through the emulated host transfer — a kernel memory disclosure primitive.\nI:H - `req->req = *_req` clobbers the `complete` function pointer while `usb_gadget_giveback_request()` is dereferencing it, giving a torn/stale indirect call plus a `context` mismatch (type confusion) that is a direct control-flow hijack primitive; the same race also lets the shared `fifo_buf` be written under a stale length, yielding controllable kernel writes.\nA:H - The reported effect is a general protection fault / kernel page fault in `dummy_timer` (syzbot faf3a6cf579fc65591ca) from calling through the clobbered pointer, i.e. a kernel oops that an unprivileged local attacker can trigger repeatedly."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/gadget/udc/dummy_hcd.c"],"versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"16a685172abc9233728830e27d26ffa778975b51","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"95f30a21612cc65761c58ba044b1767699437317","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3cab0e5498d0fbb21fe1a9181f7bda9a844a697e","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e2b2740f1242bc70b5b46da2cdbbaa419f490e59","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"67b589d09a96882d56842dced5698ed8dd06ce45","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e239ea91b48180ed48a86ac25643832a02c88456","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e24b33618231034bf01dfaff4fd3409d4b4d5b2e","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d5e5cd3654d2b5359a12ea6586120f05b28634ee","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/gadget/udc/dummy_hcd.c"],"versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","status":"unaffected","versionType":"semver"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.10.265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/16a685172abc9233728830e27d26ffa778975b51"},{"url":"https://git.kernel.org/stable/c/95f30a21612cc65761c58ba044b1767699437317"},{"url":"https://git.kernel.org/stable/c/3cab0e5498d0fbb21fe1a9181f7bda9a844a697e"},{"url":"https://git.kernel.org/stable/c/e2b2740f1242bc70b5b46da2cdbbaa419f490e59"},{"url":"https://git.kernel.org/stable/c/67b589d09a96882d56842dced5698ed8dd06ce45"},{"url":"https://git.kernel.org/stable/c/e239ea91b48180ed48a86ac25643832a02c88456"},{"url":"https://git.kernel.org/stable/c/e24b33618231034bf01dfaff4fd3409d4b4d5b2e"},{"url":"https://git.kernel.org/stable/c/d5e5cd3654d2b5359a12ea6586120f05b28634ee"}],"title":"usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback","x_generator":{"engine":"bippy-1.2.0"}}}}