CVE-2026-68374

A flaw was found in the Linux kernel's USB core subsystem. A missing synchronization mechanism in the bos_descriptors_read() function allows for a use-after-free vulnerability. This occurs when the udev->bos object is accessed while it is simultaneously being freed, potentially leading to a system crash (denial of service) or, in some cases, arbitrary code execution.

This vulnerability is rated as Moderate severity because exploitation is constrained to local users and depends on winning a complex race condition between reading USB descriptors through sysfs and an active device reset. A local attacker requires existing system access and precise timing during USB device re-initialization to trigger the memory corruption. Although a successful exploit could result in a kernel crash or privilege escalation, the requirement for concurrent operations and high attack complexity limits widespread risk across standard Red Hat Enterprise Linux deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.