CVE-2026-93117: usb: fix UAF when probe runs concurrent to dyn ID removal
In the Linux kernel, the following vulnerability has been resolved:
usb: fix UAF when probe runs concurrent to dyn ID removal
Dynamic IDs are only guaranteed to be valid when usbdynidslock is held, as removeidstore can free the node. Thus, make a copy in usbprobeinterface. Clarify the documentation that the id parameter is only valid during the probe.
USB serial has the same pattern, but it does not need fixing as the IDs cannot be removed via sysfs.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems using USB dynamic IDs are exposed when a USB interface probe can run at the same time that a dynamic ID is removed through sysfs.
What conditions are required to trigger the use-after-free?
A USB probe must access a dynamic ID concurrently with removal of that ID. Dynamic IDs are only valid while usb_dynids_lock is held because remove_id_store can free the associated node.
Is USB serial affected by the same pattern?
USB serial uses the same pattern, but it does not require this fix because its IDs cannot be removed through sysfs.
What can be done before the fix is deployed?
Avoid removing USB dynamic IDs through sysfs while USB interface probing may be occurring. The resolved fix copies the ID in usb_probe_interface so it remains safe after the dynamic-ID lock is released.