CVE-2026-63905

In the Linux kernel, the following vulnerability has been resolved:

usbip: vudc: Fix use after free bug in vudc_remove due to race condition

This patch follows up Zheng Wang's 2023 report of a use-after-free in vudc_remove(). The original thread stalled on Shuah Khan's request for runtime testing of the unplug/unbind path. This patch supplies that testing and keeps Zheng's original fix shape.

In vudcprobe(), vinittimer() binds udc->trtimer.timer to vtimer(). usbipsockfdstore() starts the timer via vstarttimer()/vkicktimer(). vudcremove() can then free the containing struct vudc while the timer is still pending or executing.

KASAN confirms the race on an unpatched x8664 QEMU guest with CONFIGKASAN=y, CONFIGUSBIPVUDC=y, CONFIGUSBZERO=y, and a tight loop that repeatedly writes a socket fd to usbip_sockfd, closes the socket pair, and unbinds/rebinds usbip-vudc.0:

BUG: KASAN: slab-use-after-free in _runtimerbase.part.0+0x8ba/0x8e0 Write of size 8 at addr ffff888001b80740 by task triggerandunb/239 Allocated by task 239: vudcprobe+0x4d/0xaa0 Freed by task 239: kfree+0x18f/0x520 devicereleasedriverinternal+0x388/0x540 unbindstore+0xd9/0x100

This lands in the timer core rather than vtimer() itself because the embedded timerlist is being walked after its containing struct vudc has already been freed. The underlying lifetime bug is the same one Zheng reported.

With vstoptimer() called from vudc_remove() and the timer deleted synchronously, the same harness completed 5000 bind/unbind iterations with no KASAN report.