CVE-2026-64454: Linux Kernel Race Condition Vulnerability

CVE-2026-64454 Overview

CVE-2026-64454 is a Linux kernel locking defect in the DesignWare USB 3.0 (dwc3) gadget driver. The function dwc3_gadget_suspend() acquires dwc->lock with interrupts disabled and then calls dwc3_disconnect_gadget(). For asynchronous callbacks that helper only uses plain spin_unlock()/spin_lock(), so the gadget ->disconnect() callback still executes with IRQs disabled. Any sleepable disconnect callback then triggers a Lockdep warning: BUG: sleeping function called from invalid context. The issue affects Linux kernel branches that ship the dwc3 gadget driver and was surfaced by static analysis with manual code review against the current tree.

Critical Impact
A sleepable gadget ->disconnect() callback invoked from dwc3_gadget_suspend() runs in an IRQ-disabled atomic context, producing Lockdep splats and potential deadlocks or scheduling faults on affected systems.

Affected Products

Linux kernel usb/dwc3 gadget driver (multiple stable branches referenced in kernel.org stable commits)
Systems using DesignWare USB3 controllers with sleepable gadget disconnect callbacks
Distributions shipping the vulnerable dwc3_gadget_suspend() code path prior to the fix

Discovery Timeline

2026-07-25 - CVE-2026-64454 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64454

Vulnerability Analysis

The defect lives in the dwc3 gadget suspend path. dwc3_gadget_suspend() disables IRQs and takes dwc->lock via spin_lock_irqsave(), then calls into dwc3_disconnect_gadget(). That helper, when invoked from the async callback path, only performs a plain spin_unlock()/spin_lock() around the callback. The consequence is that the gadget driver's ->disconnect() handler runs while local interrupts are still disabled. If the underlying gadget function driver may sleep during disconnect handling, the kernel enters an invalid context and Lockdep raises a sleeping function called from invalid context warning. Depending on the callback implementation, this can escalate into a real scheduling-while-atomic fault or a deadlock rather than a benign warning.

Root Cause

The root cause is a context mismatch between caller and callback contract. dwc3_gadget_suspend() holds the lock with IRQs disabled, while gadget ->disconnect() implementations are permitted to sleep. The existing helper does not restore a sleepable context before invoking the driver callback on the suspend path, conflating the async event path (which tolerates the plain spin release/reacquire) with the suspend path (which does not).

Attack Vector

The issue is triggered locally through normal USB gadget suspend events on affected hardware. It is a kernel stability and correctness bug rather than a directly exploitable remote flaw. Impact is primarily denial of service or kernel warnings, with any downstream security impact dependent on the specific gadget function driver in use. Refer to the kernel.org stable commit for the corrected control flow.

Detection Methods for CVE-2026-64454

Indicators of Compromise

Kernel log entries containing BUG: sleeping function called from invalid context referencing dwc3_gadget_suspend or the gadget driver's disconnect callback
Lockdep traces showing dwc3_gadget_suspend.constprop.0 in the call stack
Unexpected USB gadget disconnect timing correlated with system suspend events

Detection Strategies

Enable CONFIG_DEBUG_ATOMIC_SLEEP and CONFIG_PROVE_LOCKING on test kernels to surface the invalid-context call from dwc3_gadget_suspend()
Audit installed kernel versions against the fixed commits listed on kernel.org stable to identify unpatched systems
Correlate USB gadget subsystem dmesg output with system suspend/resume cycles in centralized log collection

Monitoring Recommendations

Forward kernel ring buffer messages to a centralized log platform and alert on sleeping function called from invalid context strings
Track kernel package versions across the fleet and flag hosts running vulnerable dwc3 code paths
Monitor for repeated kernel warnings from the usb/dwc3 subsystem that may indicate systemic exposure

How to Mitigate CVE-2026-64454

Immediate Actions Required

Update affected Linux kernels to a stable release that includes the fix commits published on kernel.org stable
Prioritize embedded and mobile platforms that rely on DesignWare USB3 gadget controllers with sleepable disconnect callbacks
Where patching is delayed, avoid triggering suspend cycles on affected gadget configurations

Patch Information

The fix keeps disconnect callback selection in one common helper and adds a sleepable suspend-side wrapper. The wrapper snapshots the callback under dwc->lock and then runs it after spin_unlock_irqrestore(), restoring a sleepable context before invoking the gadget driver. The regular event path continues to use the existing spin_unlock()/spin_lock() window. See the kernel.org stable commits 010382937fb6, 48958478cb8d, 5e5798880eb1, 642e04f5c292, b399be295845, c4e232bd07fe, and e0e4f15d4225 for the fixed backports.

Workarounds

Disable or unload gadget function drivers whose ->disconnect() handlers may sleep until the kernel is patched
Prevent runtime suspend on affected USB gadget devices via power management policy where feasible
Restrict physical or administrative access to systems that cannot be immediately updated

bash

# Verify running kernel version against fixed stable releases
uname -r

# Inspect kernel log for the diagnostic signature
dmesg | grep -E 'sleeping function|dwc3_gadget_suspend'

# Disable runtime PM on a specific USB device as a temporary mitigation
echo on | sudo tee /sys/bus/usb/devices/<device>/power/control