CVE-2026-64233: Linux Kernel Race Condition Vulnerability

CVE-2026-64233 Overview

CVE-2026-64233 is a race condition in the Linux kernel's USB gadget UVC (USB Video Class) function. The uvc_function_bind() routine walks the &opts->extension_units list twice without holding opts->lock. A privileged userspace process that keeps the configfs subtree open can bind the gadget to a UDC while concurrently issuing rmdir() against an extension unit subdirectory. This races uvcg_extension_drop() against the bind-time list walks and can dereference a freed struct uvcg_extension.

Critical Impact
Only privileged users who can mount configfs and write to gadget UDC files can trigger the race. The upstream commit describes this as a correctness fix rather than a security boundary violation.

Affected Products

Linux kernel USB gadget subsystem (drivers/usb/gadget/function/f_uvc.c)
Linux kernel UVC configfs interface (drivers/usb/gadget/function/uvc_configfs.c)
Systems exposing USB gadget UVC functions through configfs

Discovery Timeline

2026-07-24 - CVE-2026-64233 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64233

Vulnerability Analysis

The vulnerability is a race condition (use-after-free class) in the USB gadget UVC function bind path. uvc_function_bind() iterates the extension units list twice: once directly during the iExtension string-descriptor fixup loop, and four additional times indirectly through uvc_copy_descriptors() (one per USB speed). The helper iterates uvc->desc.extension_units, which aliases &opts->extension_units, to size and emit XU descriptors. None of these walks hold opts->lock.

On the configfs side, uvcg_extension_make() and uvcg_extension_drop() in drivers/usb/gadget/function/uvc_configfs.c correctly take opts->lock around their list_add_tail and list_del operations. The asymmetric locking discipline creates the window that allows a concurrent drop to free an extension unit while the bind path is still walking the list.

Root Cause

The root cause is missing synchronization between the bind path and configfs mutation callbacks. uvc_function_bind() reads a list protected by opts->lock in other code paths without acquiring that lock. When uvcg_extension_drop() removes and frees an entry mid-walk, the reader dereferences memory that has already been returned to the allocator.

Attack Vector

Triggering the race requires local privileged access. The attacker must be able to mount configfs, hold the configfs subtree open, and write to gadget UDC files to initiate the bind sequence. While the bind is in progress, the attacker issues rmdir() against an extensions subdirectory to invoke uvcg_extension_drop(). Successful timing frees a struct uvcg_extension while uvc_function_bind() still references it. The upstream fix holds opts->lock from the start of the XU string-descriptor fixup through the last uvc_copy_descriptors() call and introduces an error_unlock label to release the lock on descriptor-error paths.

No public exploit code is available. Refer to the Linux Kernel Commit for the fix details.

Detection Methods for CVE-2026-64233

Indicators of Compromise

Kernel oops or panic messages referencing uvc_function_bind, uvc_copy_descriptors, or uvcg_extension_drop in dmesg output.
KASAN use-after-free reports naming struct uvcg_extension allocations on kernels built with CONFIG_KASAN.
Unexpected UDC bind failures correlated with configfs rmdir operations on UVC extension unit subdirectories.

Detection Strategies

Audit userspace processes that mount configfs and write to /sys/kernel/config/usb_gadget/*/UDC files, particularly when concurrent with rmdir on functions/uvc.*/control/extensions/*.
Enable kernel lockdep and KASAN in test environments to surface the racing access pattern during QA.
Monitor kernel logs for repeated crashes tied to the USB gadget UVC function path.

Monitoring Recommendations

Alert on unprivileged-to-privileged transitions that precede configfs manipulation of USB gadget functions.
Track mount syscalls targeting configfs and subsequent writes to gadget UDC binding files.
Log kernel taint state changes and correlate with USB gadget subsystem stack traces.

How to Mitigate CVE-2026-64233

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the NVD advisory for your kernel branch.
Restrict access to configfs mount operations and USB gadget UDC files to trusted administrative users only.
On systems that do not require USB gadget UVC functionality, unload or disable the usb_f_uvc module.

Patch Information

The fix holds opts->lock across the XU descriptor walks in uvc_function_bind() and adds an error_unlock label to release the lock on descriptor-error paths. Patch commits are available at git.kernel.org 2c9e0905, git.kernel.org 5f1b9cff, git.kernel.org 68aa7064, git.kernel.org caec0145, and git.kernel.org e15c4140.

Workarounds

Prevent unprivileged mounting of configfs by tightening mount namespace policy and container capabilities.
Remove CAP_SYS_ADMIN from workloads that do not need gadget configuration.
Blacklist the usb_f_uvc module on production systems that do not act as USB video gadgets.

bash

# Configuration example: blacklist the UVC gadget function module
echo "blacklist usb_f_uvc" | sudo tee /etc/modprobe.d/blacklist-usb-f-uvc.conf
sudo depmod -a
sudo update-initramfs -u