A race condition vulnerability in the Linux kernel USB gadget driver could allow a local attacker to cause a kernel-level memory corruption and system instability.

The vulnerability exists in the dummy_hcd driver where a shared FIFO request structure is improperly managed during concurrent operations. A local attacker can trigger a race condition where a request completion callback is overwritten, resulting in a general protection fault or memory corruption.

Successful exploitation requires local access, but it grants an attacker the ability to trigger a kernel fault, leading to denial of service or potential privilege escalation. Given the CVSS score of 7.8, this represents a significant risk to system integrity and availability. Compromise of the kernel layer allows for complete control over the affected host, which could lead to unauthorized data access or persistent system compromise.

Immediate Action: Update the Linux kernel to version 5.10.265, 5.15.216, 6.1.183, 6.6.148, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for repeated general protection faults, kernel panics, or unexpected system reboots associated with USB subsystem activity.

Compensating Controls: Restrict access to USB device interfaces and limit the ability of non-privileged users to interact with kernel-level gadget drivers where possible.

Public Exploit Available: Unknown

This vulnerability presents a high risk to system stability and security due to its impact on the kernel layer. System administrators should prioritize patching the kernel across all relevant deployments. If an immediate reboot for a kernel update is not feasible, restrict local user access to the affected hardware interfaces to mitigate the risk of exploitation.