HIGH
usb usbtmc URB Release UAF
CVE-2026-31758
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: Flush anchored URBs in usbtmc_release When calling usbtmc_release, pending anchored URBs must be flushed or killed to prevent use-after-free errors (e.g. in the HCD giveback path). Call usbtmc_draw_down() to allow anchored URBs to be completed.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability in the USB USBTMC driver can cause kernel crashes or potential privilege escalation when USBTMC device file handles are closed while USB operations are still pending. This affects systems with connected USB test and measurement instruments and requires local access to exploit.
Vulnerability analysis
Root Cause: The usbtmc_release() function fails to properly flush pending anchored URBs before releasing file resources. When a file handle is closed, any outstanding USB Request Blocks (URBs) that were anchored to that file's data structure remain active. These URBs can complete asynchronously after the file data structures have been freed, leading to use-after-free conditions when the USB Host Controller Driver (HCD) attempts to access the freed memory during URB completion callbacks.
Attack Surface: This vulnerability affects systems with USB Test and Measurement Class (USBTMC) devices connected. The attack surface is local, requiring physical access to connect a malicious USB device or the ability to trigger specific timing conditions during file handle closure. The vulnerability can be triggered by unplugging a USBTMC device or closing file handles at specific timing windows.
Fix Mechanism: The patch adds a call to usbtmc_draw_down(file_data) in the usbtmc_release() function before releasing the io_mutex. This function properly flushes or kills all anchored URBs associated with the file handle, ensuring they complete before the file data structures are freed. This prevents the HCD from accessing freed memory during asynchronous URB completion.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 5.10 | 5.10.253 | 959ef3290711 |
| 5.15 | 5.15.203 | e189d443767f |
| 6.1 | 6.1.168 | 7fa8f61bab3f |
| 6.12 | 6.12.81 | d13318dec0c1 |
| 6.18 | 6.18.22 | 977b632db51d |
| 6.19 | 6.19.12 | d40198de5023 |
| 6.6 | 6.6.134 | 95e09b07e502 |
| mainline | 7.0 | 8a768552f7a8 |