CVE-2026-64346: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64346 Overview

CVE-2026-64346 is a use-after-free vulnerability in the Linux kernel USB gadget subsystem. The flaw resides in the gadget_match_driver() function within the USB Device Controller (UDC) core. A race condition allows usb_del_gadget() to free the udc structure through a mode-switch work item while gadget_match_driver() concurrently accesses that same memory through configfs. The freed memory is subsequently zeroed, causing a NULL pointer dereference in __pi_strcmp(). The Linux kernel maintainers have resolved the issue across multiple stable branches by introducing a usb_gadget_release() routine that keeps the udc structure allocated until the gadget itself is released.

Critical Impact
Local kernel memory corruption and denial of service through concurrent USB gadget configuration and mode-switching operations.

Affected Products

Linux kernel (upstream stable branches — see referenced commits for exact ranges)
Systems using the USB gadget subsystem with configfs-based UDC binding
Platforms using the DesignWare USB3 (dwc3) dual-role controller with mode switching

Discovery Timeline

2026-07-25 - CVE-2026-64346 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64346

Vulnerability Analysis

The udc structure in the Linux USB gadget framework serves as the management object for a gadget device. Its lifecycle is decoupled from the gadget it manages, which creates a window for concurrent access after deallocation. When a user writes to the UDC name via configfs (gadget_dev_desc_UDC_store), the kernel invokes usb_gadget_register_driver_owner() and ultimately gadget_match_driver(), which reads the udc->name string.

Concurrently, a mode-switch workqueue such as __dwc3_set_mode running on events_freezable can invoke dwc3_gadget_exit(), which calls usb_del_gadget() and frees the udc memory. The stale pointer held by the configfs path is then dereferenced. The captured crash trace shows __pi_strcmp+0x20 faulting on a virtual address of 0x0, confirming that the freed slab region was zeroed before the second thread completed its string comparison.

Root Cause

The root cause is missing reference counting between the udc structure and its owning gadget. Two independent control paths — configfs writes and dual-role mode-switch work — operate on the same object without a shared reference or lock covering both freeing and lookup.

Attack Vector

Exploitation requires local access with permission to write to configfs USB gadget attributes and the ability to trigger a controller mode switch. The vulnerability is a race condition and produces non-deterministic behavior. Successful triggering results in kernel memory corruption or a NULL pointer dereference that crashes the affected kernel thread. The patch introduces usb_gadget_release(), which drops the udc reference and then invokes the gadget's release routine, guaranteeing the udc remains valid for the gadget's lifetime.

No verified public exploit code is available. Refer to the Linux kernel commit 50eeb8e and the Linux kernel commit d026f71d for the fix implementation.

Detection Methods for CVE-2026-64346

Indicators of Compromise

Kernel oops entries referencing __pi_strcmp in the program counter with gadget_match_driver as the link register
Call stacks that include gadget_dev_desc_UDC_store, configfs_write_iter, and usb_gadget_register_driver_owner
Workqueue crashes on events_freezable involving __dwc3_set_mode and dwc3_gadget_exit

Detection Strategies

Monitor dmesg and /var/log/kern.log for Unable to handle kernel NULL pointer dereference messages tied to USB gadget symbols
Enable KASAN on test kernels to identify use-after-free reads on udc allocations during gadget teardown
Track configfs writes to /sys/kernel/config/usb_gadget/*/UDC and correlate against controller mode transitions

Monitoring Recommendations

Alert on repeated kernel crashes originating from the drivers/usb/gadget/udc/ code path
Audit which users and processes hold write access to USB gadget configfs entries
Collect kernel crash dumps for post-mortem analysis when USB gadget-related panics occur

How to Mitigate CVE-2026-64346

Immediate Actions Required

Apply the upstream stable kernel updates that include the usb_gadget_release() fix as soon as vendor packages are available
Restrict configfs write permissions on /sys/kernel/config/usb_gadget/ to trusted administrative accounts only
Inventory systems using dual-role USB controllers such as dwc3 where mode switching is exercised at runtime

Patch Information

The fix is distributed across multiple stable branches. Review the following commits to identify the appropriate backport for your kernel version: Linux kernel commit 50eeb8e, Linux kernel commit 54fa390a, Linux kernel commit 67e511d2, Linux kernel commit 7a5214da, Linux kernel commit b52476a8, and Linux kernel commit d026f71d.

Workarounds

Disable USB gadget configfs support (CONFIG_USB_CONFIGFS) on systems that do not require software-defined USB device functions
Avoid runtime mode switching on dual-role controllers by pinning the controller to host or peripheral mode via device tree or kernel parameters
Limit filesystem permissions on the configfs mount so unprivileged users cannot rebind UDCs

bash

# Restrict configfs USB gadget access to root only
mount -t configfs none /sys/kernel/config
chmod 700 /sys/kernel/config/usb_gadget