A heap-based buffer overflow in the Linux kernel USB gadget subsystem, accessible to local users, poses a high risk of system compromise.

The vulnerability exists in the UAC1 and UAC2 configfs rate-list attribute parsing logic, which fails to validate the length of input sampling rate lists before writing to fixed-size arrays. A local attacker with low privileges can trigger an out-of-bounds write by providing more than ten sampling rates, potentially leading to kernel memory corruption.

Successful exploitation of this flaw allows a local user to achieve arbitrary code execution or cause a kernel panic, leading to full system compromise or denial of service. With a CVSS score of 7.8, this vulnerability represents a significant risk to the integrity and availability of affected systems, particularly in multi-user environments or containerized deployments where local access may be granted to untrusted entities.

Immediate Action: Update the Linux kernel to version 7.2.6 or later to incorporate the necessary bounds checking for sampling rate attributes.

Proactive Monitoring: Monitor system logs for UBSAN (Undefined Behavior Sanitizer) reports or unusual kernel crashes related to USB gadget or configfs operations.

Compensating Controls: Restrict access to the configfs filesystem and USB gadget configuration interfaces to only highly trusted administrative users to prevent unauthorized triggers of this vulnerability.

Public Exploit Available: Unknown

Given the potential for kernel-level memory corruption and subsequent privilege escalation, it is imperative that organizations prioritize patching their Linux kernels. Administrators should coordinate with their distribution maintainers to ensure the fix is applied, especially on systems where USB gadget functionality is utilized.