CVE-2026-64343 - Vulnerability Details

- USB: ldusb: fix use-after-free on disconnect race

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: ldusb: fix use-after-free on disconnect race

mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]

Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().

[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s USB ldusb driver contains a use‑after‑free flaw (CWE‑825) triggered by a race condition between device disconnect and release operations. The flaw occurs because mutex_unlock can access the mutex structure after it has been released, leading to dereferencing freed memory.

Affected Systems

All Linux kernel implementations not yet patched are affected. The patch was merged in commit 02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4; kernel versions prior to that commit are vulnerable. Distributions with older kernels should verify inclusion of the fix.

Risk and Exploitability

The EPSS score is below 1% and the vulnerability is not listed in CISA KEV. The CVSS score of 5.5 indicates moderate severity. The CVE description does not specify exploitation impact, so the precise effect of the use‑after‑free flaw is not detailed. The likely attack vector could involve a malicious USB device connected to the system, but no remote network exploitation is described.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ce0d7d3f575fc1ba6a89c3c651e710355590daff`	affected	< fc55923a972e715f9a27187b47d4920709e23d85
`ce0d7d3f575fc1ba6a89c3c651e710355590daff`	affected	< e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69
`ce0d7d3f575fc1ba6a89c3c651e710355590daff`	affected	< af59829e67e11ba2511a9f8e4b9111afc7d1f550
`ce0d7d3f575fc1ba6a89c3c651e710355590daff`	affected	< 02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4
`ce0d7d3f575fc1ba6a89c3c651e710355590daff`	affected	< d8f69404e1d671326f86d378b9f5bfbd56490e9d
`ce0d7d3f575fc1ba6a89c3c651e710355590daff`	affected	< 2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915
`ce0d7d3f575fc1ba6a89c3c651e710355590daff`	affected	< a3e794136ab5e3ad1e7019175a4b837aec86db4b
`ce0d7d3f575fc1ba6a89c3c651e710355590daff`	affected	< 19bdfc7b3c179331eafa423d87e1336f43bbfeb8

Linux

affected

Version	Status	Constraints
`2.6.26`	affected	—
`0`	unaffected	< 2.6.26
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ce0d7d3f575fc1ba6a89c3c651e710355590daff,fc55923a972e715f9a27187b47d4920709e23d85)`	affected	code_commit	—
`[ce0d7d3f575fc1ba6a89c3c651e710355590daff,e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69)`	affected	code_commit	—
`[ce0d7d3f575fc1ba6a89c3c651e710355590daff,af59829e67e11ba2511a9f8e4b9111afc7d1f550)`	affected	code_commit	—
`[ce0d7d3f575fc1ba6a89c3c651e710355590daff,af59829e67e11ba2511a9f8e4b9111afc7d1f550)`	affected	code_commit	—
`[ce0d7d3f575fc1ba6a89c3c651e710355590daff,02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4)`	affected	code_commit	—
`[ce0d7d3f575fc1ba6a89c3c651e710355590daff,19bdfc7b3c179331eafa423d87e1336f43bbfeb8)`	affected	code_commit	—
`[ce0d7d3f575fc1ba6a89c3c651e710355590daff,2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915)`	affected	code_commit	—
`[ce0d7d3f575fc1ba6a89c3c651e710355590daff,a3e794136ab5e3ad1e7019175a4b837aec86db4b)`	affected	code_commit	—
`[ce0d7d3f575fc1ba6a89c3c... (truncated due to length)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.26`	affected	semver	—
`[0,2.6.26)`	unaffected	semver	—
`[5.10.261,5.10.*]`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.96,6.12.*]`	unaffected	generic	—
`[6.18.39,6.18.*]`	unaffected	generic	—
`[7.1.4,7.1.*]`	unaffected	generic	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the ldusb use‑after‑free fix.
Ensure that all installed USB drivers and firmware are up‑to‑date and include the corresponding kernel changes.
If a kernel upgrade cannot be performed immediately, consider disabling or restricting USB controller access for untrusted devices.
Monitor vendor advisories for any additional patches or configuration guidance related to USB handling.

Generated by OpenCVE AI on August 4, 2026 at 14:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4
https://git.kernel.org/stable/c/19bdfc7b3c179331eafa423d87e1336f43bbfeb8
https://git.kernel.org/stable/c/2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915
https://git.kernel.org/stable/c/a3e794136ab5e3ad1e7019175a4b837aec86db4b
https://git.kernel.org/stable/c/af59829e67e11ba2511a9f8e4b9111afc7d1f550
https://git.kernel.org/stable/c/d8f69404e1d671326f86d378b9f5bfbd56490e9d
https://git.kernel.org/stable/c/e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69
https://git.kernel.org/stable/c/fc55923a972e715f9a27187b47d4920709e23d85
https://lore.kernel.org/linux-cve-announce/2026072516-CVE-2026-64343-c9e5@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64343
https://www.cve.org/CVERecord?id=CVE-2026-64343

History

Sun, 02 Aug 2026 13:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Thu, 30 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026072516-CVE-2026-64343-c9e5@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64343 https://www.cve.org/CVERecord?id=CVE-2026-64343
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 27 Jul 2026 06:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: USB: ldusb: fix use-after-free on disconnect race mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2] Use a kref to release the driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect(). [1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most other sleeping locks, can still use the lock object after it's unlocked")
Title		USB: ldusb: fix use-after-free on disconnect race
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4 https://git.kernel.org/stable/c/19bdfc7b3c179331eafa423d87e1336f43bbfeb8 https://git.kernel.org/stable/c/2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915 https://git.kernel.org/stable/c/a3e794136ab5e3ad1e7019175a4b837aec86db4b https://git.kernel.org/stable/c/af59829e67e11ba2511a9f8e4b9111afc7d1f550 https://git.kernel.org/stable/c/d8f69404e1d671326f86d378b9f5bfbd56490e9d https://git.kernel.org/stable/c/e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69 https://git.kernel.org/stable/c/fc55923a972e715f9a27187b47d4920709e23d85

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:05.828Z

Updated: 2026-07-25T08:50:05.828Z

Reserved: 2026-07-19T15:36:31.781Z

Link: CVE-2026-64343

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:16.353

Modified: 2026-08-11T15:00:57.447

Link: CVE-2026-64343

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64343 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T14:45:03Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object