CVE-2026-68370

A flaw was found in the Linux kernel's USB gadget dummy Host Controller Driver (HCD). A race condition can occur when a shared USB request object (fifo_req) is prematurely reused before its completion callback has finished. This can lead to the overwriting of the callback pointer, causing a general protection fault or page fault. The most significant consequence is a system crash, resulting in a Denial of Service (DoS).

Red Hat Enterprise Linux is not affected by this vulnerability because the dummy Host Controller Driver (dummy_hcd) kernel module is not enabled or shipped in supported enterprise kernels. The flaw involves a race condition during USB request completion in this emulated controller, potentially leading to local memory corruption and a denial of service. Because the driver is intended purely for upstream testing and development environments, standard production systems do not carry the vulnerable code.