{"id":"CVE-2026-68374","title":"usb: core: sysfs: add lock to bos_descriptors_read()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: sysfs: add lock to bos_descriptors_read()\n\nAdd a lock to the function bos_descriptors_read().\n\nThis function accesses udev->bos, which could be simultaneousl…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 < c07caee449c968842a350bfefa049889923b8240","Linux >= 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 < 217774e143d7b5a88739193284b6421be3978601","Linux >= 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 < ab82adf5e63b2d89ead7933ab753b9cedbe028e9","Linux >= 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 < 4e0197fbb0eec588795d5431716a244d9ac8fa93","Linux 6.9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:47:33.384722Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:09.811Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68374","references":[{"url":"https://git.kernel.org/stable/c/c07caee449c968842a350bfefa049889923b8240"},{"url":"https://git.kernel.org/stable/c/217774e143d7b5a88739193284b6421be3978601"},{"url":"https://git.kernel.org/stable/c/ab82adf5e63b2d89ead7933ab753b9cedbe028e9"},{"url":"https://git.kernel.org/stable/c/4e0197fbb0eec588795d5431716a244d9ac8fa93"}],"tags":["cve.org"],"epss":0.00128,"epssPercentile":0.02204,"ingestedAt":"2026-10-16T17:24:46.861Z","slug":"CVE-2026-68374","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: sysfs: add lock to bos_descriptors_read()\n\nAdd a lock to the function bos_descriptors_read().\n\nThis function accesses udev->bos, which could be simultaneously freed in\nusb_reset_and_verify_device(), a function that is commonly called in\ndrivers all over the kernel.\n\n## Affected\n\n- `Linux >= 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 < c07caee449c968842a350bfefa049889923b8240`\n- `Linux >= 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 < 217774e143d7b5a88739193284b6421be3978601`\n- `Linux >= 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 < ab82adf5e63b2d89ead7933ab753b9cedbe028e9`\n- `Linux >= 12fc84e8c4288cc8ed5f14a35e077130c2cfece2 < 4e0197fbb0eec588795d5431716a244d9ac8fa93`\n- `Linux 6.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}