CVE-2026-89733: usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: fix dangling pointers in uvcfunctionbind() and uvcfunctionunbind()
In uvcfunctionbind() error path, we use usbepfreerequest which uses uvc->controlreq but does not set it to NULL afterwards. Thus, uvc->controlreq is a dangling pointer causing a UAF. Also we do not set the uvc->controlbuf pointer to NULL after freeing it, which is another dangling pointer. Fix it by setting uvc->controlreq to NULL after we run usbepfreerequest() and uvc->controlbuf to NULL after kfree. Do the same for uvcfunctionunbind().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In uvc_function_bind() error path, after freeing the request with usb_ep_free_request(), set uvc->control_req to NULL to prevent a dangling pointer/UAF. Also apply the same NULLing behavior in uvc_function_unbind().
Linux kernel (usb gadget: uvc) uvc->control_req = NULL - Configuration
In uvc_function_bind()/uvc_function_unbind(), after freeing uvc->control_buf (e.g., via kfree), set uvc->control_buf to NULL to prevent a dangling pointer/UAF.
Linux kernel (usb gadget: uvc) uvc->control_buf = NULL
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The issue is associated with error handling in uvc_function_bind() and cleanup in uvc_function_unbind(). It requires the USB gadget UVC function to reach code paths that free the control request or control buffer while leaving their stored pointers non-NULL.
What is the security impact of the stale pointers?
The retained uvc->control_req pointer can become a dangling pointer after usb_ep_free_request(), creating a use-after-free condition. The uvc->control_buf pointer can also remain dangling after it is freed.
What does the fix change?
The fix clears uvc->control_req after usb_ep_free_request() and clears uvc->control_buf after kfree. The same pointer cleanup is applied in both bind error handling and unbind cleanup.