CVE-2026-68374

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable code is reached by a local read() on the world-readable sysfs attribute /sys/bus/usb/devices/*/bos_descriptors, and the racing reset is driven locally via the usbfs USBDEVFS_RESET ioctl or driver error recovery. No network or physical access to the bug itself is required.

AC:LAttack complexity, low

The attacker controls both sides of the race: a loop of read() calls on the sysfs file plus repeated USBDEVFS_RESET ioctls (or induced driver resets), and the reset window spanning re-enumeration is milliseconds wide, so the race can be won reliably with retries.

PR:LPrivileges required, low

The bos_descriptors binary attribute is BIN_ATTR_RO (0444), readable by any unprivileged local user; the device-reset side is available to the seat user through usbfs uaccess/plugdev ACLs on desktops, kiosks and containers with USB device access.

UI:NUser interaction, none

No victim action is needed; the attacker performs both the sysfs read and the device reset entirely on its own, with no cooperation from another user or process.

S:UScope, unchanged

The use-after-free corrupts and discloses kernel heap memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.

C:HConfidentiality impact, high

The memcpy reads from an already-kfree()d BOS buffer and copies up to 65535 bytes straight to userspace, and because wTotalLength itself is read from the reclaimed object the read can extend past the original allocation, leaking arbitrary reallocated kernel heap contents.

I:HIntegrity impact, high

This is a use-after-free on a kmalloc'd object whose contents the attacker can influence by heap spraying into the freed slot; such UAFs on hot kernel slabs are a standard primitive for corrupting adjacent/reallocated kernel state and hijacking control flow.

A:HAvailability impact, high

Dereferencing the freed usb_host_bos and copying a length derived from reclaimed memory readily runs off the end of the slab into unmapped or poisoned pages, producing a KASAN report, oops or panic that takes the machine down.