[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/gadget/function/f_tcm.c","drivers/usb/gadget/function/tcm.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c52661d60f636d17e26ad834457db333bd1df494","lessThan":"3118bb872c7dff653294f193d5328a476619e04d","versionType":"git","status":"affected"},{"version":"c52661d60f636d17e26ad834457db333bd1df494","lessThan":"a6eb5a0ae7cd313cfd7df78decd8f43b64c68703","versionType":"git","status":"affected"},{"version":"c52661d60f636d17e26ad834457db333bd1df494","lessThan":"f282242906c12fd476b86757afba51f211d4f959","versionType":"git","status":"affected"},{"version":"c52661d60f636d17e26ad834457db333bd1df494","lessThan":"4c6c6a5588b9a2f8437fb794e852d05fa60ebe53","versionType":"git","status":"affected"},{"version":"c52661d60f636d17e26ad834457db333bd1df494","lessThan":"79e2d75725c85607f8a9d87ae9cace62a19f767d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/gadget/function/f_tcm.c","drivers/usb/gadget/function/tcm.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.5","status":"affected"},{"version":"0","lessThan":"3.5","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/gadget/function/f_tcm.c","drivers/usb/gadget/function/tcm.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c52661d60f636d17e26ad834457db333bd1df494","lessThan":"3118bb872c7dff653294f193d5328a476619e04d","versionType":"git","status":"affected"},{"version":"c52661d60f636d17e26ad834457db333bd1df494","lessThan":"a6eb5a0ae7cd313cfd7df78decd8f43b64c68703","versionType":"git","status":"affected"},{"version":"c52661d60f636d17e26ad834457db333bd1df494","lessThan":"f282242906c12fd476b86757afba51f211d4f959","versionType":"git","status":"affected"},{"version":"c52661d60f636d17e26ad834457db333bd1df494","lessThan":"4c6c6a5588b9a2f8437fb794e852d05fa60ebe53","versionType":"git","status":"affected"},{"version":"c52661d60f636d17e26ad834457db333bd1df494","lessThan":"79e2d75725c85607f8a9d87ae9cace62a19f767d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/gadget/function/f_tcm.c","drivers/usb/gadget/function/tcm.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.5","status":"affected"},{"version":"0","lessThan":"3.5","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_tcm: synchronize delayed set_alt with teardown

The f_tcm set_alt() path defers endpoint setup to a work item and
completes the delayed status response from process context. The delayed
work uses f_tcm private state and may complete the setup request after
disconnect or function teardown has already moved on.

Cancel and drain the delayed set_alt work when the function is unbound or
freed. For disable paths, which are reached under the composite device
lock, use a small state machine and a non-sleeping cancellation path
instead of cancel_work_sync(). If the work is already running, mark it
cancelled and let the worker own the cleanup; otherwise tcm_disable() can
cancel the queued work and clean up immediately.

Also serialize the final delayed-status completion with the cancellation
check while holding the composite device lock. This prevents a disconnect
from clearing delayed_status while the worker is about to complete the
control request.

Validation reproduced this kernel report:
BUG: KASAN: slab-use-after-free in tcm_delayed_set_alt+0x6c/0xef0

Call Trace:
 <TASK>
 dump_stack_lvl+0x66/0xa0
 print_report+0xce/0x630
 ? tcm_delayed_set_alt+0x6c/0xef0
 ? srso_alias_return_thunk+0x5/0xfbef5
 ? __virt_addr_valid+0x188/0x320
 ? tcm_delayed_set_alt+0x6c/0xef0
 kasan_report+0xe0/0x110
 ? tcm_delayed_set_alt+0x6c/0xef0
 tcm_delayed_set_alt+0x6c/0xef0
 ? __pfx_tcm_delayed_set_alt+0x10/0x10
 ? process_one_work+0x4cb/0xb90
 ? rcu_is_watching+0x20/0x50
 ? tcm_delayed_set_alt+0x9/0xef0
 process_one_work+0x4d7/0xb90
 ? __pfx_process_one_work+0x10/0x10
 ? srso_alias_return_thunk+0x5/0xfbef5
 ? __list_add_valid_or_report+0x37/0xf0
 ? __pfx_tcm_delayed_set_alt+0x10/0x10
 ? srso_alias_return_thunk+0x5/0xfbef5
 worker_thread+0x2d8/0x570
 ? __pfx_worker_thread+0x10/0x10
 kthread+0x1ad/0x1f0
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x3c9/0x540
 ? __pfx_ret_from_fork+0x10/0x10
 ? srso_alias_return_thunk+0x5/0xfbef5
 ? __switch_to+0x2e9/0x730
 ? __p

https://git.kernel.org/stable/c/3118bb872c7dff653294f193d5328a476619e04d

https://git.kernel.org/stable/c/4c6c6a5588b9a2f8437fb794e852d05fa60ebe53

https://git.kernel.org/stable/c/79e2d75725c85607f8a9d87ae9cace62a19f767d

https://git.kernel.org/stable/c/a6eb5a0ae7cd313cfd7df78decd8f43b64c68703

https://git.kernel.org/stable/c/f282242906c12fd476b86757afba51f211d4f959

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/gadget/function/f_tcm.c","drivers/usb/gadget/function/tcm.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c52661d60f636d17e26ad834457db333bd1df494","lessThan":"3118bb872c7dff653294f193d5328a476619e04d","versionType":"git","status":"affected"},{"version":"c52661d60f636d17e26ad834457db333bd1df494","lessThan":"a6eb5a0ae7cd313cfd7df78decd8f43b64c68703","versionType":"git","status":"affected"},{"version":"c52661d60f636d17e26ad834457db333bd1df494","lessThan":"f282242906c12fd476b86757afba51f211d4f959","versionType":"git","status":"affected"},{"version":"c52661d60f636d17e26ad834457db333bd1df494","lessThan":"4c6c6a5588b9a2f8437fb794e852d05fa60ebe53","versionType":"git","status":"affected"},{"version":"c52661d60f636d17e26ad834457db333bd1df494","lessThan":"79e2d75725c85607f8a9d87ae9cace62a19f767d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/gadget/function/f_tcm.c","drivers/usb/gadget/function/tcm.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.5","status":"affected"},{"version":"0","lessThan":"3.5","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]