CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release
In the Linux kernel, the following vulnerability has been resolved:
usb: usbtmc: Flush anchored URBs in usbtmcrelease
When calling usbtmcrelease, pending anchored URBs must be flushed or killed to prevent use-after-free errors (e.g. in the HCD giveback path). Call usbtmcdrawdown() to allow anchored URBs to be completed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In usbtmc_release, call usbtmc_draw_down() to flush or kill pending anchored URBs and allow them to complete before release.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Linux kernel with the usbtmc driver are affected when pending anchored USB Request Blocks exist as the driver is released. The issue occurs in the driver’s device-release path.
What conditions are needed to trigger the use-after-free?
A local attacker needs low-privileged access and must cause pending anchored URBs to remain when usbtmc_release is called. The vulnerable condition involves an HCD giveback path accessing URBs after their associated resources are released.
Is user interaction required?
No. The supplied CVSS vector indicates local attack access, low attack complexity, low privileges required, and no user interaction.
What is the remediation?
Apply a Linux kernel update containing the fix that calls usbtmc_draw_down() during usbtmc_release. This flushes or completes anchored URBs before release and prevents the use-after-free condition.