Re: Linux USB threat-model document

[Greg KH <gregkh@linuxfoundation.org>]

On Wed, Oct 21, 2026 at 12:53:03PM -0400, Alan Stern wrote:
> On Thu, Feb 26, 2026 at 08:29:45PM -0800, Greg KH wrote:
> > Given that I have to answer this type of question about every other week
> > these days given the fuzzing reports we get sent to the
> > security@kernel.org alias, I think I need to just write up a "here is
> > the Linux USB threat model that we currently support" document to
> > describe what the state is.
> > 
> > We can then work from there, either agreeing that we need to "move" the
> > level of interaction for which we trust / do not trust a device in the
> > lifecycle of a USB device, or just be happy with where it currently is.
> > 
> > That should work better with some groups that I know are working to do
> > stuff to "harden" the USB device stack for some specific use cases,
> > hopefully just using the existing user api that we have today that
> > USBGuard uses, or possibly adding to that to handle some missing areas
> > that we have not previously considered.
> 
> Did you ever make any progress on writing up this document?

No, been swamped by the exponental increase in stable and CVE work :(

> Have these outside groups gotten anywhere, or identified anything that 
> the kernel should do differently?

Yes, there was a presentation at the Plumbers conference in the Android
track about this and what the Android people would like to see be done
differently in order to make this into a more secure type of a system.
The slides for that should be online somewhere and the developers there
said they would be sending patches to the list for review "sometime" in
the future.  Right now I think they have a long way to go before that
happens, but at least they are thinking about it.

thanks,

greg k-h