Re: [BUG] usb: gadget: configfs: use-after-free of gadget strings during bind and under a bound gadget

[Greg Kroah-Hartman]

On Mon, Oct 19, 2026 at 01:34:15PM +1000, Yu Zhang wrote:
> Hi,
> 
> The gadget-side string configfs objects (the strings/<langid> directories
> and the strings beneath them) are created, modified and destroyed with no
> serialization against, and no lifetime coupling to, a bound gadget. This
> gives two use-after-frees, both reproduced on an acm gadget over
> dummy_hcd with KASAN. Both are root/configfs triggered.

Great, if this is a real issue that your systems run into, please submit
a patch to resolve this.

thanks,

greg k-h