CVE-2026-89733: Linux Kernel USB Gadget Use-After-Free

CVE-2026-89733 Overview

CVE-2026-89733 is a use-after-free (UAF) vulnerability in the Linux kernel's USB gadget UVC (USB Video Class) function driver. The flaw resides in uvc_function_bind() and uvc_function_unbind(), where the uvc->control_req and uvc->control_buf pointers become dangling after being freed without being set to NULL. A local attacker with low privileges can trigger the freed memory access, leading to memory corruption and potential local privilege escalation. The vulnerability affects Linux systems that use the USB gadget UVC function driver, commonly enabled in embedded devices and development boards.

Critical Impact
Successful exploitation allows local privilege escalation, kernel memory corruption, and full compromise of system confidentiality, integrity, and availability.

Affected Products

Linux kernel with USB gadget UVC function driver enabled
Multiple stable kernel branches referenced across eight upstream fix commits
Embedded Linux distributions using g_webcam or ConfigFS UVC gadget

Discovery Timeline

2026-09-11 - CVE-2026-89733 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89733

Vulnerability Analysis

The vulnerability is a use-after-free condition in the Linux kernel's USB gadget UVC driver. When uvc_function_bind() encounters an error, it calls usb_ep_free_request() on uvc->control_req to release the allocated USB endpoint request structure. The driver does not reset uvc->control_req to NULL after the release, leaving the pointer dangling. The same defect applies to uvc->control_buf, which is freed via kfree() without being cleared.

Subsequent code paths and cleanup routines can dereference these dangling pointers, resulting in access to freed kernel memory. The identical pattern exists in uvc_function_unbind(), where both pointers are freed without reset. A local attacker able to interact with the UVC gadget interface can drive the driver into the vulnerable code paths and manipulate the freed memory to achieve arbitrary kernel behavior.

Root Cause

The root cause is missing pointer nullification after memory deallocation in error and cleanup paths [CWE-416]. The kernel maintainers resolved the issue by explicitly assigning NULL to uvc->control_req after usb_ep_free_request() and to uvc->control_buf after kfree() in both uvc_function_bind() and uvc_function_unbind().

Attack Vector

Exploitation requires local access with the ability to configure or interact with USB gadget functionality, typically through ConfigFS or by loading the UVC gadget module. An attacker triggers the error path in uvc_function_bind() or a subsequent bind/unbind cycle to force the driver to reuse or reference the dangling pointers. The UAF window can then be leveraged for kernel heap manipulation, culminating in privilege escalation or denial of service.

No verified public exploit code is available. Technical details are documented in the upstream fixes, including Linux Kernel Commit 38f822d and Linux Kernel Commit 502a7f5.

Detection Methods for CVE-2026-89733

Indicators of Compromise

Unexpected kernel oops or panic messages referencing uvc_function_bind, uvc_function_unbind, or usb_ep_free_request
KASAN reports flagging use-after-free on uvc->control_req or uvc->control_buf allocations
Repeated USB gadget bind/unbind cycles originating from unprivileged users on affected hosts

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test systems to surface UAF conditions in the UVC gadget driver during fuzzing
Audit systems for presence and use of the usb_f_uvc module and ConfigFS UVC gadget composition
Correlate kernel ring buffer (dmesg) anomalies with local process activity manipulating /sys/kernel/config/usb_gadget/ entries

Monitoring Recommendations

Monitor kernel logs for crash signatures involving UVC gadget symbols and forward them to a centralized log store
Alert on unauthorized loading of usb_f_uvc or related gadget modules on production endpoints
Track privileged writes to ConfigFS gadget paths and flag anomalous bind/unbind sequences

How to Mitigate CVE-2026-89733

Immediate Actions Required

Apply the upstream kernel patches referenced in the eight stable-branch fix commits to all affected kernels
Rebuild and redeploy custom kernels that ship the usb_f_uvc module using patched sources
Restrict local user access on devices exposing USB gadget functionality until patches are deployed

Patch Information

The fix has been merged across multiple stable Linux kernel branches. Apply the vendor-provided kernel update or rebuild from source using one of the upstream commits: 38f822d, 502a7f5, 85dd5e8, 8e88ed8, 9897b7d, bdab560, bec7708, and ddb1b0d.

Workarounds

Unload the usb_f_uvc module on systems that do not require UVC gadget functionality using modprobe -r usb_f_uvc
Blacklist the module in /etc/modprobe.d/ to prevent automatic loading on reboot
Restrict ConfigFS mount permissions and limit which users can create or manipulate USB gadget configurations

bash

# Configuration example: disable usb_f_uvc module loading
echo 'blacklist usb_f_uvc' | sudo tee /etc/modprobe.d/disable-uvc-gadget.conf
sudo modprobe -r usb_f_uvc 2>/dev/null || true
sudo update-initramfs -u