CVE-2026-68367

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_tcm: synchronize delayed set_alt with teardown

The f_tcm set_alt() path defers endpoint setup to a work item and

completes the delayed status response from process context. The delayed

work uses f_tcm private state and may complete the setup request after

disconnect or function teardown has already moved on.

Cancel and drain the delayed set_alt work when the function is unbound or

freed. For disable paths, which are reached under the composite device

lock, use a small state machine and a non-sleeping cancellation path

instead of cancel_work_sync(). If the work is already running, mark it

cancelled and let the worker own the cleanup; otherwise tcm_disable() can

cancel the queued work and clean up immediately.

Also serialize the final delayed-status completion with the cancellation

check while holding the composite device lock. This prevents a disconnect

from clearing delayed_status while the worker is

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References