In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind uvc_function_bind() walks &opts->extension_units twice without holding opts->lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times via uvc_copy_descriptors() (once per speed), where the helper iterates uvc->desc.extension_units (which aliases &opts->extension_units) to size and emit XU descriptors. The configfs side (uvcg_extension_make / uvcg_extension_drop, in drivers/usb/gadget/function/uvc_configfs.c) takes opts->lock around its list_add_tail / list_del operations. A privileged userspace process that holds the configfs subtree open and writes the gadget UDC name to bind the function while concurrently rmdir()'ing an extensions subdir can race uvcg_extension_drop() against the bind-time list walks and dereference a freed struct uvcg_extension. Hold opts->lock from the start of the XU string-descriptor fixup through the last uvc_copy_descriptors() call, releasing on the descriptor-error path via a new error_unlock label that drops the lock before falling through to the existing error label. This matches the locking discipline of the configfs callbacks and removes the only remaining unsynchronised reader of the XU list during bind. Reachability: only privileged processes that can mount configfs and write to gadget UDC files can trigger the race, so this is a correctness fix rather than a security boundary.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind uvc_function_bind() walks     &opts->extension_units twice without holding opts->lock: - directly, for the iExtension string-descriptor     fixup loop; - indirectly, four times via uvc_copy_descriptors() (once per speed), where the helper     iterates uvc->desc.extension_units (which aliases &opts->extension_units) to size and emit XU descriptors.
    The configfs side (uvcg_extension_make / uvcg_extension_drop, in     drivers/usb/gadget/function/uvc_configfs.c) takes opts->lock around its list_add_tail / list_del     operations. A privileged userspace process that holds the configfs subtree open and writes the gadget UDC     name to bind the function while concurrently rmdir()'ing an extensions subdir can race     uvcg_extension_drop() against the bind-time list walks and dereference a freed struct uvcg_extension. Hold     opts->lock from the start of the XU string-descriptor fixup through the last uvc_copy_descriptors() call,     releasing on the descriptor-error path via a new error_unlock label that drops the lock before falling     through to the existing error label. This matches the locking discipline of the configfs callbacks and     removes the only remaining unsynchronised reader of the XU list during bind. Reachability: only privileged     processes that can mount configfs and write to gadget UDC files can trigger the race, so this is a     correctness fix rather than a security boundary. (CVE-2026-64233)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
333762	Photon OS 5.0: Linux PHSA-2026-5.0-92-0895	Nessus	PhotonOS Local Security Checks	Local	high
330156	Linux Distros Unpatched Vulnerability : CVE-2026-64233	Nessus	Misc.	Local	medium
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-64233

medium

Tenable Plugins

high

high

high

high

high

medium

high