Look up another CVE · open CVE-2026-89733 in the interactive tracker
CVE-2026-89733
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem drivers/usb. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-89733 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
In uvc_function_bind() error path, we use usb_ep_free_request which uses uvc->control_req but does not set it to NULL afterwards. Thus, uvc->control_req is a dangling pointer causing a UAF. Also we do not set the uvc->control_buf pointer to NULL after freeing it, which is another dangling pointer. Fix it by setting uvc->control_req to NULL after we run usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the same for uvc_function_unbind().
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/usb/gadget/function/f_uvc.c
- What this is
- USB WEBCAM GADGETMAINTAINERS section matched on drivers/usb/gadget/function/*uvc* · linux-usb@vger.kernel.org · Orphan
- Kernel module
- usb_f_uvc
Check it on the machine
grep -wE 'CONFIG_OF|CONFIG_PCI|CONFIG_USB|CONFIG_USB_F_UVC|CONFIG_USB_GADGET|CONFIG_USB_PHY|CONFIG_USB_SUPPORT' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w usb_f_uvcPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, i386/686, i386/686-pae, i386/rt/686-pae, ppc64el/powerpc64le
- trixieMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, armel/rpi, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
- forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_OF, CONFIG_PCI, CONFIG_USB, CONFIG_USB_F_UVC, CONFIG_USB_GADGET, CONFIG_USB_PHY, CONFIG_USB_SUPPORT
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.9% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/usb
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.8 | 5.10.270 | ddb1b0d5d858 |
| 3.8 | 5.15.221 | 85dd5e8bd677 |
| 3.8 | 6.1.188 | 502a7f5b79b7 |
| 3.8 | 6.6.157 | bec7708eb3b5 |
| 3.8 | 6.12.109 | 8e88ed8a374d |
| 3.8 | 6.18.50 | 9897b7da8c0a |
| 3.8 | 7.2.4 | 38f822ddce93 |
| 3.8 | 7.3 | bdab5605259b |
| 3.2.36 | 0 | 0 |
| 3.4.25 | 0 | 0 |
| 3.7.2 | 0 | 0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The UAF is reached by local writes to /sys/kernel/config/usb_gadget/<g>/UDC that drive uvc_function_bind()/uvc_function_unbind(); no USB host traffic or physical attachment is required, matching prior gadget bind dangling-pointer scores and being higher severity than Physical.
- AC:LAttack complexity, low
- The attacker controls the successful bind, the unbind that leaves uvc->control_req dangling, and a later bind that fails before reallocating (e.g. exhausting usb_ep_autoconfig(), as in the syzkaller "Unable to allocate streaming EP" crash), so the error path double-frees the usb_request with no race.
- PR:LPrivileges required, low
- gadget_dev_desc_UDC_store() and uvc_function_bind() perform no capability check; access is gated only by configfs permissions, and Android/embedded USB gadget HALs routinely delegate /sys/kernel/config/usb_gadget to non-root system or daemon accounts.
- UI:NUser interaction, none
- The attacker performs the configfs UDC bind/unbind writes themselves; no victim action, cable plug, or other-user interaction is required.
- S:UScope, unchanged
- The dangling usb_request double-free corrupts kernel heap within the same kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.
- C:HConfidentiality impact, high
- usb_ep_free_request() on the stale control_req is a use-after-free of a usb_request slab object; an attacker who sprays that cache controls the freed object and can convert the UAF into kernel memory disclosure.
- I:HIntegrity impact, high
- The same stale pointer is a double-free through ep->ops->free_request, yielding classic heap-corruption primitives (object overlap and arbitrary free) that can be leveraged into arbitrary write and control-flow hijack.
- A:HAvailability impact, high
- The syzkaller report is a KASAN slab-use-after-free oops in usb_ep_free_request() on the bind error path, and the double free independently panics the kernel, which the attacker can retrigger via configfs.