CVE-2026-43327

In the Linux kernel, the following vulnerability has been resolved:

USB: dummy-hcd: Fix locking/synchronization error

Syzbot testing was able to provoke an addressing exception and crash

in the usb_gadget_udc_reset() routine in

drivers/usb/gadgets/udc/core.c, resulting from the fact that the

routine was called with a second ("driver") argument of NULL. The bad

caller was set_link_state() in dummy_hcd.c, and the problem arose

because of a race between a USB reset and driver unbind.

These sorts of races were not supposed to be possible; commit

7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change"),

along with a few followup commits, was written specifically to prevent

them. As it turns out, there are (at least) two errors remaining in

the code. Another patch will address the second error; this one is

concerned with the first.

The error responsible for the syzbot crash occurred because the

stop_activity() routine will sometimes drop and then re-acquire the

dum->lock spinlock. A call to stop_activity() occurs in

set_link_state() when handling an emulated USB reset, after the test

of dum->ints_enabled and before the increment of dum->callback_usage.

This allowed another thread (doing a driver unbind) to sneak in and

grab the spinlock, and then clear dum->ints_enabled and dum->driver.

Normally this other thread would have to wait for dum->callback_usage

to go down to 0 before it would clear dum->driver, but in this case it

didn't have to wait since dum->callback_usage had not yet been

incremented.

The fix is to increment dum->callback_usage _before_ calling

stop_activity() instead of after. Then the thread doing the unbind

will not clear dum->driver until after the call to

usb_gadget_udc_reset() safely returns and dum->callback_usage has been

decremented again.