CVE-2026-64346

A flaw was found in the Linux kernel's USB gadget driver. A race condition exists where the udc (USB Device Controller) memory, which manages USB gadgets, can be freed while still being accessed. This use-after-free vulnerability can be triggered by a local attacker, potentially through operations like mode-switching or configuration file system (configfs) interactions. Successful exploitation leads to a NULL pointer dereference, causing a system crash and resulting in a Denial of Service (DoS).

A use-after-free race exists in the USB gadget UDC core because the usb_udc object and the gadget device have decoupled lifetimes. usb_del_gadget() can free the UDC memory during mode switch work while gadget_match_driver() concurrently accesses the same object through the configfs UDC binding path, resulting in a kernel crash. The observed failure is a NULL-pointer dereference in strcmp after the freed memory is zeroed, but the underlying primitive is a race based UAF on a kernel management object. For the CVSS the PR:L is used in the paranoid score because gadget configfs or USB role control can be exposed to reduced capability local services on embedded systems, even though normal administration usually requires root or CAP_SYS_ADMIN. The issue is local and not directly network reachable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.