CVE-2026-64346: usb: gadget: udc: Fix use-after-free in gadget_match_driver

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: udc: Fix use-after-free in gadget_match_driver

The udc structure acts as the management structure for the gadget,
but their lifecycles are decoupled. A race condition exists where
usb_del_gadget() frees the udc memory (e.g., via mode-switch work)
while gadget_match_driver() concurrently accesses the freed udc memory
(e.g., via configfs), causing a Use-After-Free (UAF) that triggers a
NULL pointer dereference when the freed memory is zeroed:

[39430.908615][ T1171] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[39430.911397][ T1171] pc : __pi_strcmp+0x20/0x140
[39430.911441][ T1171] lr : gadget_match_driver+0x34/0x60
...
[39430.911890][ T1171]  usb_gadget_register_driver_owner+0x50/0xf8
[39430.911910][ T1171]  gadget_dev_desc_UDC_store+0xf4/0x140
[39430.931308][ T1171]  configfs_write_iter+0xec/0x134

[39430.957058][ T1171] Workqueue: events_freezable __dwc3_set_mode
[39430.957287][ T1171]  dwc3_gadget_exit+0x34/0x8c
[39430.957304][ T1171]  __dwc3_set_mode+0xc0/0x664

Fix this by ensuring the udc structure remains allocated until the
gadget is released. To achieve this, introduce a new
usb_gadget_release() routine to the core. When the gadget is added,
usb_add_gadget() stores the gadget's release routine in the udc
structure and takes a reference to the udc. When the gadget is
released, usb_gadget_release() drops the reference to the udc and
then calls the gadget's release routine.

The Linux kernel CVE team has assigned CVE-2026-64346 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.15.212 with commit f845852a5a8914277031f47d8de0f350fef52405
	Fixed in 6.1.178 with commit 50eeb8e8a4f389efc91b93cff14a683e714ec194
	Fixed in 6.6.145 with commit 7a5214dae906d9f58e07bc4995e8181ee74439f4
	Fixed in 6.12.96 with commit d026f71df141c9b064ff32a78af5391a31ef75c2
	Fixed in 6.18.39 with commit b52476a83d9e12df00765359d728a875b128bef1
	Fixed in 7.1.4 with commit 54fa390aae393eb130f307a85562e3001cc39a52
	Fixed in 7.2-rc3 with commit 67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64346
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/gadget/udc/core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f845852a5a8914277031f47d8de0f350fef52405
	https://git.kernel.org/stable/c/50eeb8e8a4f389efc91b93cff14a683e714ec194
	https://git.kernel.org/stable/c/7a5214dae906d9f58e07bc4995e8181ee74439f4
	https://git.kernel.org/stable/c/d026f71df141c9b064ff32a78af5391a31ef75c2
	https://git.kernel.org/stable/c/b52476a83d9e12df00765359d728a875b128bef1
	https://git.kernel.org/stable/c/54fa390aae393eb130f307a85562e3001cc39a52
	https://git.kernel.org/stable/c/67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea