---
id: CVE-2026-93117
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: fix UAF when probe runs concurrent to dyn ID removal

  Dynamic IDs are only guaranteed to be valid when usb_dynids_lock is held,
  as remove_id_store can free the nod…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  usb: fix UAF when probe runs concurrent to dyn ID removal

  Dynamic IDs are only guaranteed to be valid when usb_dynids_lock is held,
  as remove_id_store can free the nod…
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0c7a2b72746a96f999fd2728520d03d94879be69 <
    9b82ddf76827e2a8ff033a8131ecf24f2d6cae26
  - >-
    Linux >= 0c7a2b72746a96f999fd2728520d03d94879be69 <
    44904468e58d3dc3a0229782acbeb9677b060541
  - >-
    Linux >= 0c7a2b72746a96f999fd2728520d03d94879be69 <
    64320c6e721bdec4c43a789c866c8a099dd0c843
  - >-
    Linux >= 0c7a2b72746a96f999fd2728520d03d94879be69 <
    7e795801295c84a6bbc10a3e7a4c99c50bfe45ac
  - >-
    Linux >= 0c7a2b72746a96f999fd2728520d03d94879be69 <
    e6a9c6b79b70046afdf5a1dbd03b1104536f30c0
  - >-
    Linux >= 0c7a2b72746a96f999fd2728520d03d94879be69 <
    ef8154d8b52d60338c1fd8d793cd8e891c604c14
  - Linux 2.6.33
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:18:06.300'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93117'
references:
  - url: 'https://git.kernel.org/stable/c/44904468e58d3dc3a0229782acbeb9677b060541'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/64320c6e721bdec4c43a789c866c8a099dd0c843'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7e795801295c84a6bbc10a3e7a4c99c50bfe45ac'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9b82ddf76827e2a8ff033a8131ecf24f2d6cae26'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e6a9c6b79b70046afdf5a1dbd03b1104536f30c0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ef8154d8b52d60338c1fd8d793cd8e891c604c14'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93117.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-93117'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536635'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-93117'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93117'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93117.mbox
  - url: 'https://kernelcve.org/list/?q=CVE-2026-93117'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-09-17T16:21:47.752Z'
epss: 0.00205
epssPercentile: 0.10459
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-416
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

usb: fix UAF when probe runs concurrent to dyn ID removal

Dynamic IDs are only guaranteed to be valid when usb_dynids_lock is held,
as remove_id_store can free the node. Thus, make a copy in
usb_probe_interface. Clarify the documentation that the id parameter is
only valid during the probe.

USB serial has the same pattern, but it does not need fixing as the IDs
cannot be removed via sysfs.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93117.json)