Answer in brief
CVE-2026-68367 records a Unknown severity vulnerability in usb: gadget: f_tcm: synchronize delayed set_alt with teardown. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=c52661d60f636d17e26ad834457db333bd1df494 <3118bb872c7dff653294f193d5328a476619e04d || >=c52661d60f636d17e26ad834457db333bd1df494 <a6eb5a0ae7cd313cfd7df78decd8f43b64c68703 || >=c52661d60f636d17e26ad834457db333bd1df494 <f282242906c12fd476b86757afba51f211d4f959 || >=c52661d60f636d17e26ad834457db333bd1df494 <4c6c6a5588b9a2f8437fb794e852d05fa60ebe53 || >=c52661d60f636d17e26ad834457db333bd1df494 <79e2d75725c85607f8a9d87ae9cace62a19f767d | 3118bb872c7dff653294f193d5328a476619e04d, a6eb5a0ae7cd313cfd7df78decd8f43b64c68703, f282242906c12fd476b86757afba51f211d4f959, 4c6c6a5588b9a2f8437fb794e852d05fa60ebe53, 79e2d75725c85607f8a9d87ae9cace62a19f767d |
| Linux/Linuxgeneric | 3.5 | Not reported |
| Linux/Linuxgeneric | >=c52661d60f636d17e26ad834457db333bd1df494 <8fb317058d165c88f3344f59439c14872c162b3c || >=c52661d60f636d17e26ad834457db333bd1df494 <90431d8523c0c1c9f8e3e3f0895727063f93da85 || >=c52661d60f636d17e26ad834457db333bd1df494 <ee07d09419f1c59c74f73107aa08444f2f2fc6c8 || >=c52661d60f636d17e26ad834457db333bd1df494 <3118bb872c7dff653294f193d5328a476619e04d || >=c52661d60f636d17e26ad834457db333bd1df494 <a6eb5a0ae7cd313cfd7df78decd8f43b64c68703 || >=c52661d60f636d17e26ad834457db333bd1df494 <f282242906c12fd476b86757afba51f211d4f959 || >=c52661d60f636d17e26ad834457db333bd1df494 <4c6c6a5588b9a2f8437fb794e852d05fa60ebe53 || >=c52661d60f636d17e26ad834457db333bd1df494 <79e2d75725c85607f8a9d87ae9cace62a19f767d | 8fb317058d165c88f3344f59439c14872c162b3c, 90431d8523c0c1c9f8e3e3f0895727063f93da85, ee07d09419f1c59c74f73107aa08444f2f2fc6c8, 3118bb872c7dff653294f193d5328a476619e04d, a6eb5a0ae7cd313cfd7df78decd8f43b64c68703, f282242906c12fd476b86757afba51f211d4f959, 4c6c6a5588b9a2f8437fb794e852d05fa60ebe53, 79e2d75725c85607f8a9d87ae9cace62a19f767d |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: synchronize delayed set_alt with teardown The f_tcm set_alt() path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses f_tcm private state and may complete the setup request after disconnect or function teardown has already moved on. Cancel and drain the delayed set_alt work when the function is unbound or freed. For disable paths, which are reached under the composite device lock, use a small state machine and a non-sleeping cancellation path instead of cancel_work_sync(). If the work is already running, mark it cancelled and let the worker own the cleanup; otherwise tcm_disable() can cancel the queued work and clean up immediately. Also serialize the final delayed-status completion with the cancellation check while holding the composite device lock. This prevents a disconnect from clearing delayed_status while the worker is about to complete the control request. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in tcm_delayed_set_alt+0x6c/0xef0 Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 ? tcm_delayed_set_alt+0x6c/0xef0 ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x188/0x320 ? tcm_delayed_set_alt+0x6c/0xef0 kasan_report+0xe0/0x110 ? tcm_delayed_set_alt+0x6c/0xef0 tcm_delayed_set_alt+0x6c/0xef0 ? __pfx_tcm_delayed_set_alt+0x10/0x10 ? process_one_work+0x4cb/0xb90 ? rcu_is_watching+0x20/0x50 ? tcm_delayed_set_alt+0x9/0xef0 process_one_work+0x4d7/0xb90 ? __pfx_process_one_work+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __list_add_valid_or_report+0x37/0xf0 ? __pfx_tcm_delayed_set_alt+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 worker_thread+0x2d8/0x570 ? __pfx_worker_thread+0x10/0x10 kthread+0x1ad/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3c9/0x540 ? __pfx_ret_from_fork+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __switch_to+0x2e9/0x730 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 544: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 tcm_alloc+0x68/0x180 usb_get_function+0x36/0x60 config_usb_cfg_link+0x125/0x1b0 configfs_symlink+0x322/0x890 vfs_symlink+0xc2/0x270 filename_symlinkat+0x295/0x2f0 __x64_sys_symlinkat+0x62/0x90 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 661: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kfree+0x2f9/0x530 config_usb_cfg_unlink+0x173/0x1e0 configfs_unlink+0x1fa/0x340 vfs_unlink+0x15c/0x510 filename_unlinkat+0x2ba/0x450 __x64_sys_unlinkat+0x63/0x90 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Quoted source text, attributed separately from HOL analysis.