CVE-2026-64233

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: uvc: hold opts-&gt;lock across XU walks in uvc_function_bind<br /> <br /> uvc_function_bind() walks &amp;opts-&gt;extension_units twice without holding<br /> opts-&gt;lock:<br /> <br /> - directly, for the iExtension string-descriptor fixup loop;<br /> - indirectly, four times via uvc_copy_descriptors() (once per speed),<br /> where the helper iterates uvc-&gt;desc.extension_units (which aliases<br /> &amp;opts-&gt;extension_units) to size and emit XU descriptors.<br /> <br /> The configfs side (uvcg_extension_make / uvcg_extension_drop, in<br /> drivers/usb/gadget/function/uvc_configfs.c) takes opts-&gt;lock around its<br /> list_add_tail / list_del operations. A privileged userspace process<br /> that holds the configfs subtree open and writes the gadget UDC name<br /> to bind the function while concurrently rmdir()&amp;#39;ing an extensions<br /> subdir can race uvcg_extension_drop() against the bind-time list walks<br /> and dereference a freed struct uvcg_extension.<br /> <br /> Hold opts-&gt;lock from the start of the XU string-descriptor fixup<br /> through the last uvc_copy_descriptors() call, releasing on the<br /> descriptor-error path via a new error_unlock label that drops the<br /> lock before falling through to the existing error label. This<br /> matches the locking discipline of the configfs callbacks and removes<br /> the only remaining unsynchronised reader of the XU list during bind.<br /> <br /> Reachability: only privileged processes that can mount configfs and<br /> write to gadget UDC files can trigger the race, so this is a<br /> correctness fix rather than a security boundary.