CVE-2026-68374

The CVE refers to the Linux kernel’s USB core sysfs path, where bos_descriptors_read() could access udev->bos that might be freed by usb_reset_and_verify_device(). The vulnerability fix adds a lock to bos_descriptors_read() to synchronize access and prevent use-after-free. Details in the descr...