Vulnerability-Lookup

GHSA-HH3M-2WW4-7GXQ

Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-08-14 00:31

Details

In the Linux kernel, the following vulnerability has been resolved:

usb: core: sysfs: add lock to bos_descriptors_read()

Add a lock to the function bos_descriptors_read().

This function accesses udev->bos, which could be simultaneously freed in usb_reset_and_verify_device(), a function that is commonly called in drivers all over the kernel.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-68374"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T13:20:30Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: sysfs: add lock to bos_descriptors_read()\n\nAdd a lock to the function bos_descriptors_read().\n\nThis function accesses udev-\u003ebos, which could be simultaneously freed in\nusb_reset_and_verify_device(), a function that is commonly called in\ndrivers all over the kernel.",
  "id": "GHSA-hh3m-2ww4-7gxq",
  "modified": "2026-08-14T00:31:56Z",
  "published": "2026-08-10T15:33:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68374"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/217774e143d7b5a88739193284b6421be3978601"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4e0197fbb0eec588795d5431716a244d9ac8fa93"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ab82adf5e63b2d89ead7933ab753b9cedbe028e9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c07caee449c968842a350bfefa049889923b8240"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-68374 (GCVE-0-2026-68374)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:03 – Updated: 2026-08-18 06:55

Title

usb: core: sysfs: add lock to bos_descriptors_read()

Summary

In the Linux kernel, the following vulnerability has been resolved: usb: core: sysfs: add lock to bos_descriptors_read() Add a lock to the function bos_descriptors_read(). This function accesses udev->bos, which could be simultaneously freed in usb_reset_and_verify_device(), a function that is commonly called in drivers all over the kernel.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/c07caee449c968842…
https://git.kernel.org/stable/c/217774e143d7b5a88…
https://git.kernel.org/stable/c/ab82adf5e63b2d89e…
https://git.kernel.org/stable/c/4e0197fbb0eec5887…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 , < c07caee449c968842a350bfefa049889923b8240 (git) Affected: 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 , < 217774e143d7b5a88739193284b6421be3978601 (git) Affected: 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 , < ab82adf5e63b2d89ead7933ab753b9cedbe028e9 (git) Affected: 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 , < 4e0197fbb0eec588795d5431716a244d9ac8fa93 (git)
Linux	Linux	Affected: 6.9 Unaffected: 0 , < 6.9 (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/core/sysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c07caee449c968842a350bfefa049889923b8240",
              "status": "affected",
              "version": "12fc84e8c4288cc8ed5f14a35e077130c2cfece2",
              "versionType": "git"
            },
            {
              "lessThan": "217774e143d7b5a88739193284b6421be3978601",
              "status": "affected",
              "version": "12fc84e8c4288cc8ed5f14a35e077130c2cfece2",
              "versionType": "git"
            },
            {
              "lessThan": "ab82adf5e63b2d89ead7933ab753b9cedbe028e9",
              "status": "affected",
              "version": "12fc84e8c4288cc8ed5f14a35e077130c2cfece2",
              "versionType": "git"
            },
            {
              "lessThan": "4e0197fbb0eec588795d5431716a244d9ac8fa93",
              "status": "affected",
              "version": "12fc84e8c4288cc8ed5f14a35e077130c2cfece2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/core/sysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: sysfs: add lock to bos_descriptors_read()\n\nAdd a lock to the function bos_descriptors_read().\n\nThis function accesses udev-\u003ebos, which could be simultaneously freed in\nusb_reset_and_verify_device(), a function that is commonly called in\ndrivers all over the kernel."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached by a local read() on the world-readable sysfs attribute /sys/bus/usb/devices/*/bos_descriptors, and the racing reset is driven locally via the usbfs USBDEVFS_RESET ioctl or driver error recovery. No network or physical access to the bug itself is required.\nAC:L - The attacker controls both sides of the race: a loop of read() calls on the sysfs file plus repeated USBDEVFS_RESET ioctls (or induced driver resets), and the reset window spanning re-enumeration is milliseconds wide, so the race can be won reliably with retries.\nPR:L - The bos_descriptors binary attribute is BIN_ATTR_RO (0444), readable by any unprivileged local user; the device-reset side is available to the seat user through usbfs uaccess/plugdev ACLs on desktops, kiosks and containers with USB device access.\nUI:N - No victim action is needed; the attacker performs both the sysfs read and the device reset entirely on its own, with no cooperation from another user or process.\nS:U - The use-after-free corrupts and discloses kernel heap memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The memcpy reads from an already-kfree()d BOS buffer and copies up to 65535 bytes straight to userspace, and because wTotalLength itself is read from the reclaimed object the read can extend past the original allocation, leaking arbitrary reallocated kernel heap contents.\nI:H - This is a use-after-free on a kmalloc\u0027d object whose contents the attacker can influence by heap spraying into the freed slot; such UAFs on hot kernel slabs are a standard primitive for corrupting adjacent/reallocated kernel state and hijacking control flow.\nA:H - Dereferencing the freed usb_host_bos and copying a length derived from reclaimed memory readily runs off the end of the slab into unmapped or poisoned pages, producing a KASAN report, oops or panic that takes the machine down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T06:55:59.462Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c07caee449c968842a350bfefa049889923b8240"
        },
        {
          "url": "https://git.kernel.org/stable/c/217774e143d7b5a88739193284b6421be3978601"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab82adf5e63b2d89ead7933ab753b9cedbe028e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e0197fbb0eec588795d5431716a244d9ac8fa93"
        }
      ],
      "title": "usb: core: sysfs: add lock to bos_descriptors_read()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68374",
    "datePublished": "2026-08-10T12:03:52.701Z",
    "dateReserved": "2026-07-30T09:28:09.386Z",
    "dateUpdated": "2026-08-18T06:55:59.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-HH3M-2WW4-7GXQ

CVE-2026-68374 (GCVE-0-2026-68374)

Tags

Sightings

Nomenclature