CVE-2026-64346

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: udc: Fix use-after-free in gadget_match_driver

The udc structure acts as the management structure for the gadget,

but their lifecycles are decoupled. A race condition exists where

usb_del_gadget() frees the udc memory (e.g., via mode-switch work)

while gadget_match_driver() concurrently accesses the freed udc memory

(e.g., via configfs), causing a Use-After-Free (UAF) that triggers a

NULL pointer dereference when the freed memory is zeroed:

[39430.908615][ T1171] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000

[39430.911397][ T1171] pc : __pi_strcmp+0x20/0x140

[39430.911441][ T1171] lr : gadget_match_driver+0x34/0x60

...

[39430.911890][ T1171] usb_gadget_register_driver_owner+0x50/0xf8

[39430.911910][ T1171] gadget_dev_desc_UDC_store+0xf4/0x140

[39430.931308][ T1171] configfs_write_iter+0xec/0x134

[39430.957058][ T1171] Workqueue: events_freezable __dwc3_set_mode

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References