usb: gadget: f_hid: move list and spinlock inits from bind t… (CVE-2026-31721)

Résumé

usb: gadget: f_hid: move list and spinlock inits from bind to alloc

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_hid: move list and spinlock inits from bind to alloc

There was an issue when you did the following:

setup and bind an hid gadget
open /dev/hidg0
use the resulting fd in EPOLL_CTL_ADD
unbind the UDC
bind the UDC
use the fd in EPOLL_CTL_DEL

When CONFIG_DEBUG_LIST was enabled, a list_del corruption was reported
within remove_wait_queue (via ep_remove_wait_queue). After some
debugging I found out that the queues, which f_hid registers via
poll_wait were the problem. These were initialized using
init_waitqueue_head inside hidg_bind. So effectively, the bind function
re-initialized the queues while there were still items in them.

The solution is to move the initialization from hidg_bind to hidg_alloc
to extend their lifetimes to the lifetime of the function instance.

Additionally, I found many other possibly problematic init calls in the
bind function, which I moved as well.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.0"},{"fixed":"5.10.253"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.203"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.169"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.135"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.81"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.22"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.12"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

BellSoft Alpaquita BELL-CVE-2026-31721 linux-lts Corrigé dans: 6.1.170-r0
Debian DEBIAN-CVE-2026-31721 linux Corrigé dans: 5.10.257-1
Ubuntu UBUNTU-CVE-2026-31721 linux

Résumé

Description d'origine

Paquets affectés

État des correctifs par distribution

Références