CVE-2026-63905

Description

A flaw was found in the Linux kernel's USB/IP Virtual USB Device Controller (vudc) component. A race condition exists in the vudc_remove() function, which can lead to a use-after-free vulnerability. This occurs when the system attempts to free a data structure while a timer within it is still active or pending. A local attacker could exploit this by repeatedly manipulating USB/IP devices, potentially causing memory corruption and system instability.

Understanding the Weakness (CWE)

CWE-825

Confidentiality

Technical Impact: Read Memory

If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.

Availability

Technical Impact: DoS: Crash, Exit, or Restart

If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.

Integrity,Confidentiality,Availability

Technical Impact: Execute Unauthorized Code or Commands

If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.