CVE-2026-93214: usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: ftcm: fix deadlock in usbgmaketpg()
usbgmaketpg() held deplock while calling configfsdependitemunlocked(), which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock dependency with configfsrmdir():
deplock -> configfs root inode lock -> sumutex -> deplock
In usbgmaketpg(), deplock only serialized the read of opts->ready, which is a monotonic flag that transitions from false to true exactly once (in tcmsetname()) and never reverts. Remove deplock from usbgmaketpg() entirely and use READONCE/WRITEONCE to access opts->ready locklessly instead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel USB gadget f_tcm implementation, remove dep_lock from usbg_make_tpg() and access opts->ready using READ_ONCE/WRITE_ONCE.
Event History
Frequently Asked Questions
What conditions are required to trigger the deadlock?
The deadlock requires concurrent configfs operations that create a TPG through usbg_make_tpg() and remove a configfs item through configfs_rmdir(). The problematic path occurs when usbg_make_tpg() holds dep_lock and calls configfs_depend_item_unlocked(), which takes the configfs root inode lock across subsystems.
What is the operational impact?
The circular lock dependency can cause the involved kernel tasks to deadlock. This can prevent the affected configfs and USB gadget target operations from completing.
Is there a workaround if the fix cannot be applied immediately?
The provided information does not identify a configuration workaround. Avoiding concurrent TPG creation and configfs item removal would avoid the specific lock ordering described, but the data does not establish this as a complete mitigation.