CVE-2026-64338 - Vulnerability Details

- USB: misc: uss720: unregister parport on probe failure

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: misc: uss720: unregister parport on probe failure

uss720_probe() registers a parport before reading the 1284 register used
to detect unsupported Belkin F5U002 adapters. If get_1284_register()
fails, the error path drops the driver private data and the USB device
reference, but leaves the parport device registered.

Leaving the port registered is more than a private allocation leak:
parport_register_port() has already reserved a parport number and
registered the parport bus device, while pp->private_data still points at
the private data that the common error path is about to release.

Undo the pre-announce registration in the get_1284_register() failure
branch before jumping to the common private-data cleanup path. Clear
priv->pp first, matching the disconnect path and avoiding a stale pointer
in the private data.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Published: 2026-07-25

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`04736c1bc32197f7d859e01a96ae80a16659931d`	affected	< 6bbb98bec71b577fda4f4b48f7aea5874b04a576
`4eaf2331a77996bbbaf2b824d452ac8ebda7e6e7`	affected	< 93563243377f8e9b46cc94d9c4f06533dd31b141
`8fc246a8a456679993df565d3c9e3da28030ee43`	affected	< 1712fd71a5aaf81e47c747f180535fa963ad7830
`10132ccf99f49b43aeb7470df50d72344a601ad6`	affected	< 0b3073f40cc9f95d5ff0037eb0a06f5c1725a7ea
`3295f1b866bfbcabd625511968e8a5c541f9ab32`	affected	< 5e62d7857fd51b908b8371062ee839739a086bbe
`3295f1b866bfbcabd625511968e8a5c541f9ab32`	affected	< 729b68a5bad71220ae0914c8bdab9488ad5be6c8
`3295f1b866bfbcabd625511968e8a5c541f9ab32`	affected	< 48dd0b2ec9f2e97c486eb68cd0a64b25c1c3df3e
`3295f1b866bfbcabd625511968e8a5c541f9ab32`	affected	< b4ecbdc4f8830f5586c4a5cfc384c00f20f8f8b3
`02d13616ca30014ed96302e51a5b0e17664e58bc`	affected	—
`dff3b01e91a3df93063b03d0f8dd5c40546687ec`	affected	—
`489d77fbd66375972a380d207f7eb39b00c4a67b`	affected	—
`5.10.221`	affected	< 5.10.261
`5.15.162`	affected	< 5.15.212
`6.1.96`	affected	< 6.1.178
`6.6.36`	affected	< 6.6.145
`4.19.317`	affected	< 4.20
`5.4.279`	affected	< 5.5
`6.9.7`	affected	< 6.10

Linux

affected

Version	Status	Constraints
`6.10`	affected	—
`0`	unaffected	< 6.10
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[04736c1bc32197f7d859e01a96ae80a16659931d,6bbb98bec71b577fda4f4b48f7aea5874b04a576)`	affected	code_commit	—
`[4eaf2331a77996bbbaf2b824d452ac8ebda7e6e7,93563243377f8e9b46cc94d9c4f06533dd31b141)`	affected	code_commit	—
`[8fc246a8a456679993df565d3c9e3da28030ee43,1712fd71a5aaf81e47c747f180535fa963ad7830)`	affected	code_commit	—
`[10132ccf99f49b43aeb7470df50d72344a601ad6,0b3073f40cc9f95d5ff0037eb0a06f5c1725a7ea)`	affected	code_commit	—
`[3295f1b866bfbcabd625511968e8a5c541f9ab32,5e62d7857fd51b908b8371062ee839739a086bbe)`	affected	code_commit	—
`[3295f1b866bfbcabd625511968e8a5c541f9ab32,729b68a5bad71220ae0914c8bdab9488ad5be6c8)`	affected	code_commit	—
`[3295f1b866bfbcabd625511968e8a5c541f9ab32,48dd0b2ec9f2e97c486eb68cd0a64b25c1c3df3e)`	affected	code_commit	—
`[3295f1b866bfbcabd625511968e8a5c541f9ab32,b4ecbdc4f8830f5586c4a5cfc384c00f20f8f8b3)`	affected	code_commit	—
`02d13616ca30014ed96302e51a5b0e17664e58bc`	affected	code_commit	—
`dff3b01e91a3df93063b03d0f8dd5c40546687ec`	affected	code_commit	—
`489d77fbd66375972a380d207f7eb39b00c4a67b`	affected	code_commit	—
`[5.10.221,5.10.261)`	affected	semver	—
`[5.15.162,5.15.212)`	affected	semver	—
`[6.1.96,6.1.178)`	affected	semver	—
`[6.6.36,6.6.145)`	affected	semver	—
`[4.19.317,4.20)`	affected	semver	—
`[5.4.279,5.5)`	affected	semver	—
`[6.9.7,6.10)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.10`	affected	semver	—
`[0,6.10)`	unaffected	semver	—
`[5.10.261,5.10.*]`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.96,6.12.*]`	unaffected	generic	—
`[6.18.39,6.18.*]`	unaffected	generic	—
`[7.1.4,7.1.*]`	unaffected	generic	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0b3073f40cc9f95d5ff0037eb0a06f5c1725a7ea
https://git.kernel.org/stable/c/1712fd71a5aaf81e47c747f180535fa963ad7830
https://git.kernel.org/stable/c/48dd0b2ec9f2e97c486eb68cd0a64b25c1c3df3e
https://git.kernel.org/stable/c/5e62d7857fd51b908b8371062ee839739a086bbe
https://git.kernel.org/stable/c/6bbb98bec71b577fda4f4b48f7aea5874b04a576
https://git.kernel.org/stable/c/729b68a5bad71220ae0914c8bdab9488ad5be6c8
https://git.kernel.org/stable/c/93563243377f8e9b46cc94d9c4f06533dd31b141
https://git.kernel.org/stable/c/b4ecbdc4f8830f5586c4a5cfc384c00f20f8f8b3

History

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: USB: misc: uss720: unregister parport on probe failure uss720_probe() registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002 adapters. If get_1284_register() fails, the error path drops the driver private data and the USB device reference, but leaves the parport device registered. Leaving the port registered is more than a private allocation leak: parport_register_port() has already reserved a parport number and registered the parport bus device, while pp->private_data still points at the private data that the common error path is about to release. Undo the pre-announce registration in the get_1284_register() failure branch before jumping to the common private-data cleanup path. Clear priv->pp first, matching the disconnect path and avoiding a stale pointer in the private data. This issue was identified during our ongoing static-analysis research while reviewing kernel code.
Title		USB: misc: uss720: unregister parport on probe failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b3073f40cc9f95d5ff0037eb0a06f5c1725a7ea https://git.kernel.org/stable/c/1712fd71a5aaf81e47c747f180535fa963ad7830 https://git.kernel.org/stable/c/48dd0b2ec9f2e97c486eb68cd0a64b25c1c3df3e https://git.kernel.org/stable/c/5e62d7857fd51b908b8371062ee839739a086bbe https://git.kernel.org/stable/c/6bbb98bec71b577fda4f4b48f7aea5874b04a576 https://git.kernel.org/stable/c/729b68a5bad71220ae0914c8bdab9488ad5be6c8 https://git.kernel.org/stable/c/93563243377f8e9b46cc94d9c4f06533dd31b141 https://git.kernel.org/stable/c/b4ecbdc4f8830f5586c4a5cfc384c00f20f8f8b3

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:02.673Z

Updated: 2026-07-25T08:50:02.673Z

Reserved: 2026-07-19T15:36:31.781Z

Link: CVE-2026-64338

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-25T13:45:03Z

Weaknesses

No weakness.

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object