CVE-2026-68374: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68374 is a race condition vulnerability in the Linux kernel's USB core sysfs subsystem, specifically in the bos_descriptors_read() function. The function accesses udev->bos without proper synchronization, which can be simultaneously freed by usb_reset_and_verify_device() during device reset operations — a function called widely across kernel drivers. It was published on August 10, 2026, and affects Linux kernel versions before 6.12.101, 6.18.42, and 7.1.6. The CVSS base score is currently listed as 0.0 with a medium severity estimate pending full scoring (GitHub Advisory, EUVD).

The root cause is a use-after-free (UAF) condition arising from a time-of-check/time-of-use race (CWE-416) in the Linux kernel's USB sysfs layer. When a user reads BOS (Binary Object Store) descriptors via sysfs while a concurrent USB device reset is in progress, usb_reset_and_verify_device() can free the udev->bos structure before bos_descriptors_read() finishes accessing it. The fix adds a proper lock to bos_descriptors_read() to serialize access and prevent concurrent modification. Patches are available as stable commits: c07caee449c9 (one branch), 217774e143d7 (another branch), ab82adf5e63b, and 4e0197fbb0ee (GitHub Advisory).

Successful exploitation of this vulnerability can cause a kernel crash, resulting in a denial of service (DoS) on the affected system. A local user with access to the sysfs filesystem can trigger the use-after-free condition by reading USB BOS descriptor files while a USB device reset is simultaneously occurring. There is no evidence of confidentiality or integrity impact beyond system availability; lateral movement potential is limited given the local access requirement (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the disclosure date. The EPSS score is 0.0, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the system and the ability to trigger concurrent USB device reset and sysfs read operations (GitHub Advisory, Feedly).

Apply the available kernel patches that introduce proper locking in bos_descriptors_read(). Fixed versions are Linux kernel 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5 or later. The corresponding stable commits are c07caee449c9, 217774e143d7, ab82adf5e63b, and 4e0197fbb0ee. No configuration-based workaround is documented; upgrading to a patched kernel version is the recommended remediation (GitHub Advisory).