CVE-2026-68374 Overview
CVE-2026-68374 is a race condition in the Linux kernel USB core sysfs interface. The function bos_descriptors_read() accesses udev->bos without holding a lock. The usb_reset_and_verify_device() function can free this structure concurrently. This function is called from many USB drivers throughout the kernel. A local attacker with low privileges can trigger the race to cause memory corruption or a use-after-free condition.
Critical Impact
A local, authenticated attacker can exploit the race between sysfs BOS descriptor reads and USB device reset to cause use-after-free, leading to kernel memory corruption with high confidentiality, integrity, and availability impact.
Affected Products
- Linux kernel USB core subsystem (drivers/usb/core/sysfs.c)
- Stable kernel branches referenced by commits 217774e143d7, 4e0197fbb0ee, ab82adf5e63b, and c07caee449c9
- Systems exposing USB device BOS descriptor sysfs entries to unprivileged users
Discovery Timeline
- 2026-08-10 - CVE-2026-68374 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68374
Vulnerability Analysis
The vulnerability resides in bos_descriptors_read() inside the USB core sysfs code. This handler is invoked when userspace reads the bos_descriptors sysfs attribute of a USB device. It dereferences udev->bos to copy Binary Object Store descriptors into the caller's buffer.
No synchronization protected access to udev->bos. Meanwhile, usb_reset_and_verify_device() re-enumerates a USB device and reallocates or frees the BOS structure. Because USB drivers call the reset path across the kernel, the free path can execute in parallel with a sysfs read from userspace.
The result is a classic race between a reader and a writer that culminates in a use-after-free on kernel heap memory. The fix adds appropriate locking around bos_descriptors_read() so that the sysfs handler cannot observe udev->bos while it is being torn down.
Root Cause
The root cause is missing synchronization on a shared pointer. bos_descriptors_read() reads udev->bos without acquiring the device lock that usb_reset_and_verify_device() respects when freeing and reallocating the BOS. The bug is a race condition ([CWE-362]) that manifests as a use-after-free ([CWE-416]) when the reset path wins the race.
Attack Vector
Exploitation is local. An attacker with permission to read the USB device's sysfs bos_descriptors attribute repeatedly triggers reads while causing device resets from another thread. Device resets can be induced through legitimate driver operations, USB errors, or actions available to users with access to USB endpoints. Successful races corrupt kernel memory and can be leveraged for privilege escalation.
No public proof-of-concept exploit code is available. The vulnerability mechanism is described in the upstream commits linked in the Kernel Git Commit Fix and the Kernel Git Commit Patch.
Detection Methods for CVE-2026-68374
Indicators of Compromise
- Kernel oops or panic messages referencing bos_descriptors_read or usb_reset_and_verify_device in dmesg or /var/log/kern.log
- KASAN use-after-free reports involving the USB BOS structure on kernels with KASAN enabled
- Unexpected USB device disconnects or resets coinciding with sysfs read activity from unprivileged processes
Detection Strategies
- Monitor kernel logs for slab-use-after-free traces mentioning udev->bos or USB core sysfs symbols
- Audit processes that read /sys/bus/usb/devices/*/bos_descriptors in tight loops alongside USB reset activity
- Correlate USB reset events with sysfs access spikes from the same UID to identify race attempts
Monitoring Recommendations
- Ship kernel ring buffer output to a centralized logging pipeline and alert on USB core stack traces
- Track running kernel versions across the fleet and flag hosts on unpatched stable branches
- Enable auditd rules covering reads on USB sysfs attributes from non-root UIDs
How to Mitigate CVE-2026-68374
Immediate Actions Required
- Apply the upstream Linux kernel patches that add locking to bos_descriptors_read() as soon as your distribution publishes updated packages
- Inventory Linux hosts and prioritize systems where untrusted local users have shell access or where physical USB access is available
- Restrict access to USB device sysfs attributes for unprivileged users where feasible
Patch Information
The fix adds a lock around bos_descriptors_read() to serialize access with usb_reset_and_verify_device(). It is landed in the stable trees via commits 217774e143d7, 4e0197fbb0ee, ab82adf5e63b, and c07caee449c9. Rebuild or update to a kernel that includes these commits and reboot affected hosts.
Workarounds
- Tighten permissions on /sys/bus/usb/devices/*/bos_descriptors via udev rules so only root can read the attribute
- Disable or unload USB host controller drivers on servers that do not require USB device support
- Deny local shell access to untrusted users on systems that cannot be patched immediately
# Restrict access to USB BOS descriptor sysfs attribute via udev
# /etc/udev/rules.d/99-usb-bos-restrict.rules
SUBSYSTEM=="usb", ACTION=="add", RUN+="/bin/sh -c 'chmod 0400 /sys/bus/usb/devices/%k/bos_descriptors 2>/dev/null || true'"
# Reload udev rules
udevadm control --reload-rules
udevadm trigger --subsystem-match=usb
# Verify running kernel includes the fix
uname -r
dmesg | grep -i "usb.*bos"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
