CVE-2026-64453
Gravedad:
Pendiente de análisis
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
25/07/2026
Última modificación:
25/07/2026
Descripción
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
usb: misc: usbio: fix disconnect UAF in client teardown<br />
<br />
usbio_disconnect() walks usbio->cli_list in reverse and uninitializes each<br />
auxiliary device. auxiliary_device_uninit() drops the device reference, and<br />
for an unbound child that can run usbio_auxdev_release() and free the<br />
containing struct usbio_client.<br />
<br />
list_for_each_entry_reverse() advances after the loop body by reading<br />
client->link.prev. If the current client is freed by<br />
auxiliary_device_uninit(), the iterator dereferences freed memory.<br />
<br />
Use list_for_each_entry_safe_reverse() so the previous client is<br />
cached before the body can drop the final reference. This preserves<br />
reverse teardown order while keeping the next iterator cursor independent<br />
of the current client&#39;s lifetime.<br />
<br />
Validation reproduced this kernel report:<br />
BUG: KASAN: slab-use-after-free in usbio_disconnect+0x12e/0x150<br />
<br />
Call Trace:<br />
<br />
dump_stack_lvl+0x66/0xa0<br />
print_report+0xce/0x630<br />
? usbio_disconnect+0x12e/0x150<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
? __virt_addr_valid+0x188/0x320<br />
? usbio_disconnect+0x12e/0x150<br />
kasan_report+0xe0/0x110<br />
? usbio_disconnect+0x12e/0x150<br />
usbio_disconnect+0x12e/0x150<br />
usb_unbind_interface+0xf3/0x400<br />
really_probe+0x316/0x660<br />
__driver_probe_device+0x106/0x240<br />
driver_probe_device+0x4a/0x110<br />
__device_attach_driver+0xf1/0x1a0<br />
? __pfx___device_attach_driver+0x10/0x10<br />
bus_for_each_drv+0xf9/0x160<br />
? __pfx_bus_for_each_drv+0x10/0x10<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
? trace_hardirqs_on+0x18/0x130<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
? _raw_spin_unlock_irqrestore+0x44/0x60<br />
__device_attach+0x133/0x2a0<br />
? __pfx___device_attach+0x10/0x10<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
? do_raw_spin_unlock+0x9a/0x100<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
device_initial_probe+0x55/0x70<br />
bus_probe_device+0x4a/0xd0<br />
device_add+0x9b9/0xc10<br />
? __pfx_device_add+0x10/0x10<br />
? _raw_spin_unlock_irqrestore+0x44/0x60<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
? lockdep_hardirqs_on_prepare+0xea/0x1a0<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
? usb_enable_lpm+0x3c/0x260<br />
usb_set_configuration+0xb64/0xf20<br />
usb_generic_driver_probe+0x5f/0x90<br />
usb_probe_device+0x71/0x1b0<br />
really_probe+0x46b/0x660<br />
__driver_probe_device+0x106/0x240<br />
driver_probe_device+0x4a/0x110<br />
__device_attach_driver+0xf1/0x1a0<br />
? __pfx___device_attach_driver+0x10/0x10<br />
bus_for_each_drv+0xf9/0x160<br />
? __pfx_bus_for_each_drv+0x10/0x10<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
? trace_hardirqs_on+0x18/0x130<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
? _raw_spin_unlock_irqrestore+0x44/0x60<br />
__device_attach+0x133/0x2a0<br />
? __pfx___device_attach+0x10/0x10<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
? do_raw_spin_unlock+0x9a/0x100<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
device_initial_probe+0x55/0x70<br />
bus_probe_device+0x4a/0xd0<br />
device_add+0x9b9/0xc10<br />
? __pfx_device_add+0x10/0x10<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
? add_device_randomness+0xb7/0xf0<br />
usb_new_device+0x492/0x870<br />
hub_event+0x1b10/0x29c0<br />
? __pfx_hub_event+0x10/0x10<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
? lock_acquire+0x187/0x300<br />
? process_one_work+0x475/0xb90<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
? lock_release+0xc8/0x290<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
process_one_work+0x4d7/0xb90<br />
? __pfx_process_one_work+0x10/0x10<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
? __list_add_valid_or_report+0x37/0xf0<br />
? __pfx_hub_event+0x10/0x10<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
worker_thread+0x2d8/0x570<br />
? __pfx_worker_thread+0x10/0x10<br />
kthread+0x1ad/0x1f0<br />
? __pfx_kthread+0x10/0x10<br />
ret_from_fork+0x3c9/0x540<br />
? __pfx_ret_from_fork+0x10/0x10<br />
? srso_alias_return_thunk+0x5/0xfbef5<br />
? __switch_to+0x2e9/0x730<br />
? __pfx_kthread+0x10/0x10<br />
ret_from_fork_asm+0x1a/0x30<br />