CVE-2026-68374: usb: core: sysfs: add lock to bos_descriptors_read()
In the Linux kernel, the following vulnerability has been resolved:
usb: core: sysfs: add lock to bosdescriptorsread()
Add a lock to the function bosdescriptorsread().
This function accesses udev->bos, which could be simultaneously freed in usbresetandverifydevice(), a function that is commonly called in drivers all over the kernel.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68374?
CVE-2026-68374 has a risk score of 34.
How do I fix CVE-2026-68374?
To fix CVE-2026-68374, ensure that you are using a patched version of the Linux kernel that includes the lock addition to the bos_descriptors_read() function.
What systems are affected by CVE-2026-68374?
CVE-2026-68374 affects Linux kernel versions prior to the resolution of September 2026.
What is bos_descriptors_read() in relation to CVE-2026-68374?
bos_descriptors_read() is a function in the Linux kernel that requires a lock due to concurrent access risks.
What could happen if CVE-2026-68374 is exploited?
If exploited, CVE-2026-68374 could lead to potential crashes or undefined behavior in systems using the affected Linux kernel.