« Volver al listado

CVE-2026-93214

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()

usbg_make_tpg() held dep_lock while calling configfs_depend_item_unlocked(), which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock dependency with configfs_rmdir():

In usbg_make_tpg(), dep_lock only serialized the read of opts->ready, which is a monotonic flag that transitions from false to true exactly once (in tcm_set_name()) and never reverts. Remove dep_lock from usbg_make_tpg() entirely and use READ_ONCE/WRITE_ONCE to access opts->ready locklessly instead.

Detalles técnicos trazas, registros y código del informe original
  dep_lock -> configfs root inode lock -> su_mutex -> dep_lock

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-93214",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4bb8548df632187d5db50878e71804af5f7c51ad",
              "lessThan": "abad5daa41cf5d0a0a9cba0397d3a0e7f11e0277",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4bb8548df632187d5db50878e71804af5f7c51ad",
              "lessThan": "3639438a4c83ffc2e564c8c010b92137c5d11cfa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4bb8548df632187d5db50878e71804af5f7c51ad",
              "lessThan": "78a14ea2284825055ab6c2a1f3489510f560f3a2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4bb8548df632187d5db50878e71804af5f7c51ad",
              "lessThan": "eef3e62f90d86c1c5651742f84ecc9db1814a893",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4bb8548df632187d5db50878e71804af5f7c51ad",
              "lessThan": "f81a2da137b029a282b9bc64d2f267d242948659",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4bb8548df632187d5db50878e71804af5f7c51ad",
              "lessThan": "6bcd9ee6ad6989d1d85a7459687e45b7ad7568d9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4bb8548df632187d5db50878e71804af5f7c51ad",
              "lessThan": "d90b0f90e30cd59b36005a4016b15cf02bcd7fb2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4bb8548df632187d5db50878e71804af5f7c51ad",
              "lessThan": "9dbf74f4022f80f7669d2b3c22c5deb46c1b5674",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/usb/gadget/function/f_tcm.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.5",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/usb/gadget/function/f_tcm.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-24T16:17:16.397",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3639438a4c83ffc2e564c8c010b92137c5d11cfa",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6bcd9ee6ad6989d1d85a7459687e45b7ad7568d9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/78a14ea2284825055ab6c2a1f3489510f560f3a2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9dbf74f4022f80f7669d2b3c22c5deb46c1b5674",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/abad5daa41cf5d0a0a9cba0397d3a0e7f11e0277",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d90b0f90e30cd59b36005a4016b15cf02bcd7fb2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/eef3e62f90d86c1c5651742f84ecc9db1814a893",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f81a2da137b029a282b9bc64d2f267d242948659",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_tcm: fix deadlock in usbg_make_tpg()\n\nusbg_make_tpg() held dep_lock while calling\nconfigfs_depend_item_unlocked(), which acquires the configfs root\ninode lock when operating across subsystems. This creates a circular\nlock dependency with configfs_rmdir():\n\n  dep_lock -> configfs root inode lock -> su_mutex -> dep_lock\n\nIn usbg_make_tpg(), dep_lock only serialized the read of opts->ready,\nwhich is a monotonic flag that transitions from false to true exactly\nonce (in tcm_set_name()) and never reverts. Remove dep_lock from\nusbg_make_tpg() entirely and use READ_ONCE/WRITE_ONCE to access\nopts->ready locklessly instead."
    }
  ],
  "lastModified": "2026-09-24T16:17:16.397",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}