CVE-2026-64344 - Vulnerability Details

- USB: idmouse: fix use-after-free on disconnect race

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: idmouse: fix use-after-free on disconnect race

mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]

Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().

[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition between the release() function and disconnect() in the Linux kernel’s idmouse USB driver can trigger an unsafe mutex unlock that accesses freed data. This issue falls under CWE-364, a use‑after‑free weakness. If an attacker can induce this race, a use‑after‑free occurs, potentially causing a kernel crash or enabling arbitrary code execution with kernel privileges, as documented by the remediation commit series.

Affected Systems

Affected are all builds of the Linux kernel that the idmouse driver but precede the patch added by commit IDs 31e75fed8f90cfea9f8285e7ed135b0e452bf872, 54c2b7356b4aeea467f9fb13b85e9e036bc428cb, 60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09, 8d53b14ad4ccbff6d306b3a39c812303f4a87d41, d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4, e88cff5fbaa629f3cab45c8b46f395d62c2eb515, f62622e947f82a3854b8502d09492ffbdeb252b4, ff002c153f9722caece3983cc23dc4d9d4652cb4. The fix replaces the unsafe reference counting with a kref‑based release, eliminating the race.

Risk and Exploitability

EPSS is reported as < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of exploitation. The CVSS score of 5.5 denotes moderate severity, suggesting that a successful attack could lead to a kernel crash or privilege escalation. The attack vector is likely local or tied to a physically connected USB device rather than remote network compromise.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`54d2bc068fd21bcb096660938bce7c7265613a24`	affected	< 31e75fed8f90cfea9f8285e7ed135b0e452bf872
`54d2bc068fd21bcb096660938bce7c7265613a24`	affected	< 8d53b14ad4ccbff6d306b3a39c812303f4a87d41
`54d2bc068fd21bcb096660938bce7c7265613a24`	affected	< f62622e947f82a3854a8502d09492ffbdeb252b4
`54d2bc068fd21bcb096660938bce7c7265613a24`	affected	< 60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09
`54d2bc068fd21bcb096660938bce7c7265613a24`	affected	< d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4
`54d2bc068fd21bcb096660938bce7c7265613a24`	affected	< 54c2b7356b4aeea467f9fb13b85e9e036bc428cb
`54d2bc068fd21bcb096660938bce7c7265613a24`	affected	< e88cff5fbaa629f3cab45c8b46f395d62c2eb515
`54d2bc068fd21bcb096660938bce7c7265613a24`	affected	< ff002c153f9722caece3983cc23dc4d9d4652cb4

Linux

affected

Version	Status	Constraints
`2.6.24`	affected	—
`0`	unaffected	< 2.6.24
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[54d2bc068fd21bcb096660938bce7c7265613a24,31e75fed8f90cfea9f8285e7ed135b0e452bf872)`	affected	code_commit	—
`[54d2bc068fd21bcb096660938bce7c7265613a24,8d53b14ad4ccbff6d306b3a39c812303f4a87d41)`	affected	code_commit	—
`[54d2bc068fd21bcb096660938bce7c7265613a24,f62622e947f82a3854a8502d09492ffbdeb252b4)`	affected	code_commit	—
`[54d2bc068fd21bcb096660938bce7c7265613a24,60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09)`	affected	code_commit	—
`[54d2bc068fd21bcb096660938bce7c7265613a24,d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4)`	affected	code_commit	—
`[54d2bc068fd21bcb096660938bce7c7265613a24,54c2b7356b4aeea467f9fb13b85e9e036bc428cb)`	affected	code_commit	—
`[54d2bc068fd21bcb096660938bce7c7265613a24,e88cff5fbaa629f3cab45c8b46f395d62c2eb515)`	affected	code_commit	—
`[54d2bc068fd21bcb096660938bce7c7265613a24,ff002c153f9722caece3983cc23dc4d9d4652cb4)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.24`	affected	semver	—
`[0,2.6.24)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that contains the commit series fixing the race in the idmouse driver.
If an immediate kernel upgrade is not possible, temporarily disable hotplug USB devices or restrict access to the idmouse driver by applying appropriate udev rules or kernel parameters to prevent the race from occurring.
Monitor system logs (dmesg, journalctl) for OOPS or panic messages mentioning idmouse, and plan to apply the upgrade as soon as it becomes available.

Generated by OpenCVE AI on August 3, 2026 at 19:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/31e75fed8f90cfea9f8285e7ed135b0e452bf872
https://git.kernel.org/stable/c/54c2b7356b4aeea467f9fb13b85e9e036bc428cb
https://git.kernel.org/stable/c/60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09
https://git.kernel.org/stable/c/8d53b14ad4ccbff6d306b3a39c812303f4a87d41
https://git.kernel.org/stable/c/d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4
https://git.kernel.org/stable/c/e88cff5fbaa629f3cab45c8b46f395d62c2eb515
https://git.kernel.org/stable/c/f62622e947f82a3854a8502d09492ffbdeb252b4
https://git.kernel.org/stable/c/ff002c153f9722caece3983cc23dc4d9d4652cb4
https://lore.kernel.org/linux-cve-announce/2026072516-CVE-2026-64344-3b7c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64344
https://www.cve.org/CVERecord?id=CVE-2026-64344

History

Sat, 01 Aug 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Thu, 30 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://lore.kernel.org/linux-cve-announce/2026072516-CVE-2026-64344-3b7c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64344 https://www.cve.org/CVERecord?id=CVE-2026-64344
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 26 Jul 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect race mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2] Use a kref to release the driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect(). [1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most other sleeping locks, can still use the lock object after it's unlocked")
Title		USB: idmouse: fix use-after-free on disconnect race
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/31e75fed8f90cfea9f8285e7ed135b0e452bf872 https://git.kernel.org/stable/c/54c2b7356b4aeea467f9fb13b85e9e036bc428cb https://git.kernel.org/stable/c/60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09 https://git.kernel.org/stable/c/8d53b14ad4ccbff6d306b3a39c812303f4a87d41 https://git.kernel.org/stable/c/d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4 https://git.kernel.org/stable/c/e88cff5fbaa629f3cab45c8b46f395d62c2eb515 https://git.kernel.org/stable/c/f62622e947f82a3854a8502d09492ffbdeb252b4 https://git.kernel.org/stable/c/ff002c153f9722caece3983cc23dc4d9d4652cb4

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:50:06.461Z

Updated: 2026-07-25T08:50:06.461Z

Reserved: 2026-07-19T15:36:31.781Z

Link: CVE-2026-64344

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:16.487

Modified: 2026-08-11T15:00:57.447

Link: CVE-2026-64344

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64344 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T19:15:04Z

Weaknesses

CWE-364
Signal Handler Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object