Heimdall Security Logo

CVE-2026-68370

Vulnérabilité élevée dans Linux (Linux)

CVSS 7.8 · Élevée
EPSS 0.1%
Linux•Linux•Versions : <=6.1.*, <=6.12.*, 2.6.12, 6.12.101, 0, <e24b33618231034bf01dfaff4fd3409d4b4d5b2e, <=7.1.*, <2.6.12, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 5.15.216, <d5e5cd3654d2b5359a12ea6586120f05b28634ee, <16a685172abc9233728830e27d26ffa778975b51, <=5.10.*, <=6.6.*, 6.18.42, <95f30a21612cc65761c58ba044b1767699437317, 7.1.6, 6.1.183, <e239ea91b48180ed48a86ac25643832a02c88456, <3cab0e5498d0fbb21fe1a9181f7bda9a844a697e, <=6.18.*, <67b589d09a96882d56842dced5698ed8dd06ce45, <=*, <=5.15.*, <e2b2740f1242bc70b5b46da2cdbbaa419f490e59, 5.10.265, 6.6.148, 7.2

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback dummy_hcd embeds a single shared usb_request (dum->fifo_req) that the "emulated single-request FIFO" fast-path in dummy_queue() reuses for small IN transfers: it copies the caller's request into it (req->req = *_req) and queues it, treating list_empty(&fifo_req.queue) as "the slot is free". The completion side (dummy_timer/transfer/nuke/dummy_dequeue) follows the standard pattern: list_del_init(&req->queue) unlinks the request, then the lock is dropped and usb_gadget_giveback_request() invokes req->complete(). But list_del_init() makes fifo_req.queue look empty *before* the completion callback returns, so a concurrent dummy_queue() on another CPU sees the slot as free, reuses fifo_req and runs req->req = *_req -- overwriting req->complete while dummy_timer is mid-calling it. The indirect call then jumps to a clobbered pointer, causing a general protection fault / page fault in dummy_timer (syzkaller extid faf3a6cf579fc65591ca). The clobbering write is an in-bounds memcpy on a live shared object, so KASAN cannot flag it. Add a fifo_req_busy bit covering the shared request's whole lifetime: set it in dummy_queue() when the FIFO fast-path takes fifo_req (making it the fast-path guard, replacing the list_empty(&fifo_req.queue) test), and clear it after the completion callback has returned, via a dummy_giveback() helper used at all four gadget-request giveback sites. The shared slot can no longer be reused until its completion callback has finished.

Gravité et risque d'exploitation

CVE-2026-68370 obtient un score CVSS de 7.8/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.14 %, ce qui la place devant 2.9 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions <=6.1.*, <=6.12.*, 2.6.12, 6.12.101, 0, <e24b33618231034bf01dfaff4fd3409d4b4d5b2e, <=7.1.*, <2.6.12, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 5.15.216, <d5e5cd3654d2b5359a12ea6586120f05b28634ee, <16a685172abc9233728830e27d26ffa778975b51, <=5.10.*, <=6.6.*, 6.18.42, <95f30a21612cc65761c58ba044b1767699437317, 7.1.6, 6.1.183, <e239ea91b48180ed48a86ac25643832a02c88456, <3cab0e5498d0fbb21fe1a9181f7bda9a844a697e, <=6.18.*, <67b589d09a96882d56842dced5698ed8dd06ce45, <=*, <=5.15.*, <e2b2740f1242bc70b5b46da2cdbbaa419f490e59, 5.10.265, 6.6.148, 7.2) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE