CVE-2026-98765: USB: gadget: dummy-hcd: Fix wait for outstanding request completions
In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: dummy-hcd: Fix wait for outstanding request completions
The dummy-hcd driver emulates synchronizeirq() by waiting until its private callbackusage counter drops to 0 (with the private lock not held). This counter is incremented whenever a gadget driver callback occurs (which requires the private lock to be dropped), but not when a request completion handler is called.
This is an oversight. Request completion is triggered by timer interrupts (emulating device IRQs in a real UDC), and the interrupt handlers are supposed to have completed when the synchronizeirq() emulation routine returns -- they aren't supposed to be in the middle of a completion callback. If this happens it can lead to a gadget driver's unbind routine running before all outstanding request completions have finished, maybe even allowing the gadget driver's module to be unloaded while a completion handler is still running.
Fix the oversight by incrementing the callbackusage value across request completion callbacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's dummy-hcd USB gadget driver are relevant. The issue involves gadget-driver request completion callbacks and driver unbind or module-unload activity.
What condition is needed to trigger the race?
A request completion callback must still be running when dummy-hcd's synchronize_irq() emulation concludes and the gadget driver's unbind routine begins. Request completions are triggered by timer interrupts emulating device IRQs.
What is the potential impact?
A gadget driver's unbind routine may run before outstanding request completion callbacks finish. This may allow the gadget-driver module to be unloaded while a completion handler is still executing.
How does the fix address the problem?
The fix increments dummy-hcd's callback_usage counter while request completion callbacks execute. This makes the synchronize_irq() emulation wait for those callbacks to finish before returning.