Threats tagged 'ghsa-m9p5-m8gg-jgg8'

CVE-2026-31726 is a vulnerability in the Linux kernel's USB gadget UVC function where a NULL pointer dereference can occur during an unbind race condition, particularly during power management transitions. This flaw can lead to a kernel panic when the system resumes from suspend or aborts suspend, causing instability. The issue arises because the unbind thread nullifies a gadget pointer prematurely, and subsequent access attempts trigger the fault. The vulnerability has been addressed by introducing synchronization mechanisms including a flag with mutex protection and explicit completion synchronization to prevent use-after-free conditions.