CVE-2024-38628

usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.

State: Published
Severity: 7.8 High
Published: Jun 21, 2024
Updated: Aug 5, 2026
Reserved: Jun 18, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.

Hang on to the control IDs instead of pointers since those are correctly handled with locks.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	02de698ca8123782c0c6fb8ed99080e2f032b0d2 to before 89e66809684485590ea0b32c3178e42cba36ac09Affected 02de698ca8123782c0c6fb8ed99080e2f032b0d2 to before 453d3fa9266e53f85377b911c19b9a4563fa88c0Affected 02de698ca8123782c0c6fb8ed99080e2f032b0d2 to before bea73b58ab67fe581037ad9cdb93c2557590c068Affected 02de698ca8123782c0c6fb8ed99080e2f032b0d2 to before 1b739388aa3f8dfb63a9fca777e6dfa6912d0464Affected
LinuxLinux	5.15Affected before 5.15Not affected 6.1.93 through 6.1.Not affected 6.6.33 through 6.6.Not affected 6.9.4 through 6.9.*Not affected 6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.