An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind uvc_function_bind() walks     &opts->extension_units twice without holding opts->lock: - directly, for the iExtension string-descriptor     fixup loop; - indirectly, four times via uvc_copy_descriptors() (once per speed), where the helper     iterates uvc->desc.extension_units (which aliases &opts->extension_units) to size and emit XU descriptors.
    The configfs side (uvcg_extension_make / uvcg_extension_drop, in     drivers/usb/gadget/function/uvc_configfs.c) takes opts->lock around its list_add_tail / list_del     operations. A privileged userspace process that holds the configfs subtree open and writes the gadget UDC     name to bind the function while concurrently rmdir()'ing an extensions subdir can race     uvcg_extension_drop() against the bind-time list walks and dereference a freed struct uvcg_extension. Hold     opts->lock from the start of the XU string-descriptor fixup through the last uvc_copy_descriptors() call,     releasing on the descriptor-error path via a new error_unlock label that drops the lock before falling     through to the existing error label. This matches the locking discipline of the configfs callbacks and     removes the only remaining unsynchronised reader of the XU list during bind. Reachability: only privileged     processes that can mount configfs and write to gadget UDC files can trigger the race, so this is a     correctness fix rather than a security boundary. (CVE-2026-64233)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	8/13/2026	9/7/2026	high
333762	Photon OS 5.0: Linux PHSA-2026-5.0-92-0895	Nessus	PhotonOS Local Security Checks	8/10/2026	8/21/2026	high
330156	Linux Distros Unpatched Vulnerability : CVE-2026-64233	Nessus	Misc.	7/27/2026	9/8/2026	medium
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	8/26/2026	8/26/2026	high
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	6/26/2026	8/25/2026	high
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	9/7/2026	9/7/2026	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	8/26/2026	8/26/2026	high

Detections

Analytics

Plugins Search

high

high

medium

high

high

high

high