The Linux kernel's usbip subsystem had a use-after-free bug in the vudc_remove() function caused by a race condition where a timer callback could access a vudc structure after it was freed. The timer was started in usbip_sockfd_store() and bound in vudc_probe(), but vudc_remove() could free the structure while the timer was still pending or running. This lifetime bug was confirmed by KASAN reports showing slab-use-after-free errors during repeated bind/unbind cycles. The patch stops and synchronously deletes the timer in vudc_remove(), preventing the use-after-free condition and eliminating KASAN errors in testing.

This vulnerability could lead to use-after-free memory corruption in the Linux kernel's usbip virtual USB device controller, potentially causing kernel crashes or undefined behavior. No known exploits in the wild have been reported. The impact is limited to systems running affected kernel configurations with usbip vudc enabled.

A patch fixing this use-after-free bug has been applied to the Linux kernel. Users should update to a kernel version that includes this fix. Since this is not a cloud service, remediation depends on applying the official kernel update. Patch status is not explicitly stated in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and update accordingly.