CVE-2026-68370

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback

dummy_hcd embeds a single shared usb_request (dum->fifo_req) that the

"emulated single-request FIFO" fast-path in dummy_queue() reuses for

small IN transfers: it copies the caller's request into it

(req->req = *_req) and queues it, treating list_empty(&fifo_req.queue)

as "the slot is free".

The completion side (dummy_timer/transfer/nuke/dummy_dequeue) follows

the standard pattern: list_del_init(&req->queue) unlinks the request,

then the lock is dropped and usb_gadget_giveback_request() invokes

req->complete(). But list_del_init() makes fifo_req.queue look empty

*before* the completion callback returns, so a concurrent dummy_queue()

on another CPU sees the slot as free, reuses fifo_req and runs

req->req = *_req -- overwriting req->complete while dummy_timer is

mid-calling it. The indirect call then jumps to a clobbered pointer,

causing a general protect

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References