CVE-2026-64233
kernel: usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
Loading…
Severity
ModerateRed Hat Product Security
CVSS
Review impact separately from score.
Published · July 24, 2026
Updated · October 20, 2026
Description
A flaw was found in the Linux kernel's USB Video Class (UVC) gadget driver. A privileged local user can exploit a race condition during the binding of a UVC function by concurrently removing an extension subdirectory. This can lead to a use-after-free vulnerability, potentially causing system instability or a denial of service.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CWE-416 · Use After Free