CVE-2026-64233: usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind

uvc_function_bind() walks &opts->extension_units twice without holding
opts->lock:

  - directly, for the iExtension string-descriptor fixup loop;
  - indirectly, four times via uvc_copy_descriptors() (once per speed),
    where the helper iterates uvc->desc.extension_units (which aliases
    &opts->extension_units) to size and emit XU descriptors.

The configfs side (uvcg_extension_make / uvcg_extension_drop, in
drivers/usb/gadget/function/uvc_configfs.c) takes opts->lock around its
list_add_tail / list_del operations.  A privileged userspace process
that holds the configfs subtree open and writes the gadget UDC name
to bind the function while concurrently rmdir()'ing an extensions
subdir can race uvcg_extension_drop() against the bind-time list walks
and dereference a freed struct uvcg_extension.

Hold opts->lock from the start of the XU string-descriptor fixup
through the last uvc_copy_descriptors() call, releasing on the
descriptor-error path via a new error_unlock label that drops the
lock before falling through to the existing error label.  This
matches the locking discipline of the configfs callbacks and removes
the only remaining unsynchronised reader of the XU list during bind.

Reachability: only privileged processes that can mount configfs and
write to gadget UDC files can trigger the race, so this is a
correctness fix rather than a security boundary.

The Linux kernel CVE team has assigned CVE-2026-64233 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.3 with commit 0525210c9840229e42c6b68e886c72a75a67cf8e and fixed in 6.6.143 with commit e15c414092b3c24610cc771e481a723b0f645eca
	Issue introduced in 6.3 with commit 0525210c9840229e42c6b68e886c72a75a67cf8e and fixed in 6.12.93 with commit 2c9e0905ef7e69f7b814cd709613f6b3b5b98805
	Issue introduced in 6.3 with commit 0525210c9840229e42c6b68e886c72a75a67cf8e and fixed in 6.18.35 with commit caec0145e5974e85fe5192fc6a6f5aa1a98f82a6
	Issue introduced in 6.3 with commit 0525210c9840229e42c6b68e886c72a75a67cf8e and fixed in 7.0.12 with commit 5f1b9cff88982e2a2053d8b1fd983f7ccb9f03cc
	Issue introduced in 6.3 with commit 0525210c9840229e42c6b68e886c72a75a67cf8e and fixed in 7.1 with commit 68aa70648b625fa684bc0b71bbfd905f4943ca20

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64233
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/gadget/function/f_uvc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e15c414092b3c24610cc771e481a723b0f645eca
	https://git.kernel.org/stable/c/2c9e0905ef7e69f7b814cd709613f6b3b5b98805
	https://git.kernel.org/stable/c/caec0145e5974e85fe5192fc6a6f5aa1a98f82a6
	https://git.kernel.org/stable/c/5f1b9cff88982e2a2053d8b1fd983f7ccb9f03cc
	https://git.kernel.org/stable/c/68aa70648b625fa684bc0b71bbfd905f4943ca20