CVE-2026-64233

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the uvc function bind() function where the opts->lock is not held while walking &opts->extension units. This occurs directly during the iExtension string-descriptor fixup loop and indirectly through four calls to uvc copy descriptors(), which iterates uvc->desc.extension units. Because the configfs side uses opts->lock for list add tail and list del operations in uvcg extension make() and uvcg extension drop(), a race condition can occur. A privileged userspace process that binds the function while simultaneously removing an extensions subdirectory can cause uvcg extension drop() to race against the bind-time list walks, leading to the dereference of a freed struct uvcg extension.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.