CVE-2026-68370 Overview
CVE-2026-68370 is a race condition in the Linux kernel's USB gadget subsystem, specifically in the dummy_hcd driver. The flaw allows concurrent reuse of a shared usb_request structure (dum->fifo_req) during request giveback, corrupting the req->complete function pointer while dummy_timer is invoking it. Exploitation triggers a general protection fault or page fault through an indirect call to a clobbered pointer. The condition was reproduced by syzkaller (extid faf3a6cf579fc65591ca) and has been patched in mainline Linux.
Critical Impact
A local attacker with the ability to interact with the dummy_hcd USB gadget can trigger memory corruption of a live shared object, causing kernel crashes and potentially enabling code execution via the clobbered indirect call target.
Affected Products
- Linux kernel builds including the dummy_hcd USB gadget driver
- Stable branches prior to the commits listed in the patch references
- Systems using USB gadget emulation for testing or virtualization
Discovery Timeline
- 2026-08-10 - CVE-2026-68370 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68370
Vulnerability Analysis
The dummy_hcd driver embeds a single shared usb_request named dum->fifo_req. The emulated single-request FIFO fast-path in dummy_queue() reuses this structure for small IN transfers by copying the caller's request into it with req->req = *_req and then queuing it. The fast-path treats list_empty(&fifo_req.queue) as the signal that the slot is free.
The completion side, spanning dummy_timer, transfer, nuke, and dummy_dequeue, calls list_del_init(&req->queue) to unlink the request. It then drops the lock and calls usb_gadget_giveback_request() to invoke req->complete(). Because list_del_init() marks fifo_req.queue as empty before the completion callback returns, a concurrent dummy_queue() on another CPU observes the slot as free.
The second CPU reuses fifo_req and executes req->req = *_req, overwriting req->complete while dummy_timer is mid-call. The indirect call then jumps to a clobbered function pointer.
Root Cause
The root cause is a race condition [TOCTOU] between the FIFO slot availability check and the completion callback lifecycle. Because the clobbering write is an in-bounds memcpy on a live shared object, KASAN cannot flag it as a memory safety violation.
Attack Vector
A local user capable of driving USB gadget operations against dummy_hcd can race dummy_queue() against giveback processing. The overwritten req->complete pointer is dereferenced during timer-driven completion, yielding a general protection fault or an attacker-influenced control-flow transfer in kernel context.
No verified public exploit code exists. The condition was reproduced by syzkaller fuzzing.
Detection Methods for CVE-2026-68370
Indicators of Compromise
- Kernel general protection fault or page fault traces originating in dummy_timer or usb_gadget_giveback_request
- Unexpected crashes on hosts using dummy_hcd for USB gadget testing or CI fuzzing
- syzkaller reports referencing extid faf3a6cf579fc65591ca or the dummy_hcd fast-path
Detection Strategies
- Monitor /var/log/kern.log, dmesg, and journalctl -k for oops traces referencing dummy_hcd, dummy_queue, or dummy_timer
- Enable kernel lockdep and KCSAN in test environments to surface data races on fifo_req
- Track loaded kernel modules and flag hosts where dummy_hcd is loaded outside expected test infrastructure
Monitoring Recommendations
- Ingest kernel logs into a centralized SIEM and alert on repeated general protection fault events in USB gadget code paths
- Baseline USB gadget module usage across the fleet and investigate anomalies
- Correlate crash telemetry with user sessions to identify local actors driving the race
How to Mitigate CVE-2026-68370
Immediate Actions Required
- Apply the upstream Linux kernel patches that introduce the fifo_req_busy bit and the dummy_giveback() helper
- Unload dummy_hcd on production systems where USB gadget emulation is not required using modprobe -r dummy_hcd
- Restrict local access on systems that must retain the module loaded
Patch Information
The fix adds a fifo_req_busy bit that covers the shared request's entire lifetime. dummy_queue() sets the bit when the FIFO fast-path takes fifo_req, replacing the list_empty(&fifo_req.queue) check. The bit is cleared only after the completion callback returns, via a new dummy_giveback() helper used at all four gadget-request giveback sites. Patches are available in the mainline and stable trees: commit 67b589d0, commit d5e5cd36, commit e239ea91, commit e24b3361, and commit e2b2740f.
Workarounds
- Blacklist the dummy_hcd module on hosts that do not need USB gadget emulation
- Limit local shell access and gadget subsystem privileges to trusted service accounts
- Isolate USB gadget testing workloads to dedicated VMs that can be rebooted after crashes
# Configuration example: prevent dummy_hcd from loading
echo "blacklist dummy_hcd" | sudo tee /etc/modprobe.d/blacklist-dummy_hcd.conf
sudo modprobe -r dummy_hcd 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
