CVE-2026-68374: usb: core: sysfs: add lock to bos_descriptors_read()

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-10 · updated 2026-10-19
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: usb: core: sysfs: add lock to bos_descriptors_read() Add a lock to the function bos_descriptors_read(). This function accesses udev->bos, which could be simultaneously freed in usb_reset_and_verify_device(), a function that is commonly called in drivers all over the kernel.

Affected products

Linux kernel: 6.9 — fixed in 7.2

How to fix

Upgrade to a fixed version: Linux kernel 7.2. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/217774e143d7b5a88739193284b6421be3978601
https://git.kernel.org/stable/c/4e0197fbb0eec588795d5431716a244d9ac8fa93
https://git.kernel.org/stable/c/ab82adf5e63b2d89ead7933ab753b9cedbe028e9
https://git.kernel.org/stable/c/c07caee449c968842a350bfefa049889923b8240

Get alerted when CVE-2026-68374 or the next vulnerability affects your stack