CVE-2026-63905: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63905 Overview

CVE-2026-63905 is a use-after-free vulnerability in the Linux kernel's USB/IP virtual USB Device Controller (vudc) driver. The flaw resides in the vudc_remove() function and stems from a race condition between driver unbind and a pending timer callback. When vudc_probe() initializes udc->tr_timer.timer via v_init_timer(), subsequent calls to usbip_sockfd_store() start the timer through v_start_timer() and v_kick_timer(). A driver unbind can then free the enclosing struct vudc while the timer is still pending or executing. KASAN confirms the race on x86_64 with tight bind/unbind loops. The upstream fix invokes v_stop_timer() from vudc_remove() and deletes the timer synchronously.

Critical Impact
A local user with permission to bind or unbind the usbip-vudc driver can trigger kernel memory corruption, potentially leading to denial of service or local privilege escalation.

Affected Products

Linux kernel builds compiled with CONFIG_USBIP_VUDC=y or as a module
Distributions shipping the mainline USB/IP virtual UDC driver prior to the referenced stable commits
Systems where unprivileged or semi-privileged users can access USB/IP sysfs bind interfaces

Discovery Timeline

2023 - Original use-after-free in vudc_remove() reported by Zheng Wang
2026-07-19 - CVE-2026-63905 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63905

Vulnerability Analysis

The vulnerability is a classic use-after-free triggered by a race between driver teardown and a kernel timer. In vudc_probe(), the driver calls v_init_timer() to bind udc->tr_timer.timer to the v_timer() callback. The timer is then armed by userspace writing a socket file descriptor to usbip_sockfd, which invokes v_start_timer() and v_kick_timer().

If an attacker unbinds the driver via sysfs unbind_store while the timer is still pending or running, vudc_remove() calls kfree() on the containing struct vudc without first deleting the timer. The kernel timer core subsequently walks the embedded timer_list in freed memory, producing a slab-use-after-free write of size 8 detected by KASAN in __run_timer_base.

Root Cause

The root cause is missing lifetime synchronization between the vudc object and its embedded timer_list. The removal path frees the container before the timer is cancelled, violating the invariant that a timer must not outlive its backing allocation. The fix adds a synchronous v_stop_timer() call in vudc_remove() so the timer is guaranteed inactive before memory release.

Attack Vector

Exploitation requires local access with the ability to write to USB/IP sysfs entries such as usbip_sockfd and bind/unbind. The reproduction harness repeatedly writes a socket pair fd to usbip_sockfd, closes the socket, and then unbinds and rebinds usbip-vudc.0. The window between arming the timer and freeing struct vudc is short but reliably reachable under load. Successful triggering corrupts kernel slab memory and, with careful heap grooming, can be steered toward code execution in kernel context.

No public exploit code is available for CVE-2026-63905. See the upstream stable commits referenced below for patch-level technical details.

Detection Methods for CVE-2026-63905

Indicators of Compromise

KASAN reports of slab-use-after-free in __run_timer_base referencing allocations from vudc_probe
Kernel oops or general protection faults originating in the timer core shortly after usbip-vudc unbind events
Repeated writes to /sys/devices/platform/usbip-vudc.*/usbip_sockfd followed by driver unbind operations

Detection Strategies

Enable CONFIG_KASAN on test and staging kernels to surface the race during fuzzing
Audit kernel logs for usbip-vudc load, bind, and unbind sequences originating from unexpected users
Correlate sysfs writes to usbip_sockfd, bind, and unbind with process ancestry to identify anomalous automation

Monitoring Recommendations

Monitor loaded kernel modules for usbip-vudc, usbip-core, and vhci-hcd on systems that do not require USB/IP
Alert on kernel ring buffer entries containing KASAN, BUG:, or general protection fault referencing timer symbols
Track access to /sys/bus/platform/drivers/usbip-vudc/ for bind and unbind activity outside change windows

How to Mitigate CVE-2026-63905

Immediate Actions Required

Update to a Linux kernel release that includes the upstream fix commits referenced by the NVD entry
Unload the usbip-vudc module on systems that do not use USB/IP device emulation
Restrict sysfs write access to USB/IP driver bind and unbind interfaces to root only

Patch Information

The fix is distributed across multiple stable branches. The relevant upstream commits are Kernel Git Commit 1036ac6, Kernel Git Commit 207bf80, Kernel Git Commit 61704e5, Kernel Git Commit 88d459e, Kernel Git Commit a0638db, Kernel Git Commit d07ed70, Kernel Git Commit d962096, and Kernel Git Commit dcc1c90. Each commit adds the synchronous v_stop_timer() call to vudc_remove().

Workarounds

Blacklist the usbip-vudc module on hosts that do not require USB/IP device emulation
Ensure only privileged administrators can execute modprobe, rmmod, or write to /sys/bus/platform/drivers/usbip-vudc/
Disable USB/IP entirely in kernel configuration by unsetting CONFIG_USBIP_VUDC for custom builds

bash

# Blacklist the vulnerable module until the host is patched
echo 'blacklist usbip-vudc' | sudo tee /etc/modprobe.d/blacklist-usbip-vudc.conf
sudo rmmod usbip-vudc 2>/dev/null || true

# Restrict access to USB/IP sysfs bind interfaces
sudo chmod 600 /sys/bus/platform/drivers/usbip-vudc/bind \
               /sys/bus/platform/drivers/usbip-vudc/unbind