CVE-2026-68374: usb: core: sysfs: add lock to bos_descriptors_read()
In the Linux kernel, the following vulnerability has been resolved:
usb: core: sysfs: add lock to bosdescriptorsread()
Add a lock to the function bosdescriptorsread().
This function accesses udev->bos, which could be simultaneously freed in usbresetandverifydevice(), a function that is commonly called in drivers all over the kernel.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Configuration
Add a lock to bos_descriptors_read() when accessing udev->bos to prevent it from being freed concurrently by usb_reset_and_verify_device().
Linux kernel USB core sysfs bos_descriptors_read() locking = lock udev->bos access
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68374?
CVE-2026-68374 has a risk score of 34.
How do I fix CVE-2026-68374?
To fix CVE-2026-68374, ensure that you are using a patched version of the Linux kernel that includes the lock addition to the bos_descriptors_read() function.
What systems are affected by CVE-2026-68374?
CVE-2026-68374 affects Linux kernel versions prior to the resolution of September 2026.
What is bos_descriptors_read() in relation to CVE-2026-68374?
bos_descriptors_read() is a function in the Linux kernel that requires a lock due to concurrent access risks.
What could happen if CVE-2026-68374 is exploited?
If exploited, CVE-2026-68374 could lead to potential crashes or undefined behavior in systems using the affected Linux kernel.