CVE-2026-68370
Description
A flaw was found in the Linux kernel's USB gadget dummy Host Controller Driver (HCD). A race condition can occur when a shared USB request object (fifo_req) is prematurely reused before its completion callback has finished. This can lead to the overwriting of the callback pointer, causing a general protection fault or page fault. The most significant consequence is a system crash, resulting in a Denial of Service (DoS).
Statement
Red Hat Enterprise Linux is not affected by this vulnerability because the dummy Host Controller Driver (dummy_hcd) kernel module is not enabled or shipped in supported enterprise kernels. The flaw involves a race condition during USB request completion in this emulated controller, potentially leading to local memory corruption and a denial of service. Because the driver is intended purely for upstream testing and development environments, standard production systems do not carry the vulnerable code.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Other
Technical Impact: Modify Application Data; Read Application Data; Alter Execution Logic; Unexpected State
If access to a shared resource is not correctly synchronized, then the resource may not be in a state that is expected by the product. This might lead to unexpected or insecure behaviors, especially if an attacker can influence the shared resource.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
