CVE-2026-31758

usb: usbtmc: Flush anchored URBs in usbtmc_release

State: Published
Severity: 7.8 High
Published: May 1, 2026
Updated: Oct 19, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: usbtmc: Flush anchored URBs in usbtmc_release

When calling usbtmc_release, pending anchored URBs must be flushed or killed to prevent use-after-free errors (e.g. in the HCD giveback path). Call usbtmc_draw_down() to allow anchored URBs to be completed.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	4f3c8d6eddc272b386464524235440a418ed2029 to before 959ef329071136e4335b54822fe2f607659b4569Affected 4f3c8d6eddc272b386464524235440a418ed2029 to before e189d443767f7cd390c52f2e122e1fc41c7562d6Affected 4f3c8d6eddc272b386464524235440a418ed2029 to before 7fa8f61bab3fb75b5deba8a0f3abb74dc5068d9fAffected 4f3c8d6eddc272b386464524235440a418ed2029 to before 95e09b07e50290254b28b8395509473104518f8cAffected 4f3c8d6eddc272b386464524235440a418ed2029 to before d13318dec0c1e0e2ac16f8ecbd522db14cea4bb1Affected 4f3c8d6eddc272b386464524235440a418ed2029 to before 977b632db51d231dec0bc571089a5c2402674139Affected 4f3c8d6eddc272b386464524235440a418ed2029 to before d40198de50232e04c14c6e2092e896766c95ea48Affected 4f3c8d6eddc272b386464524235440a418ed2029 to before 8a768552f7a8276fb9e01d49773d2094ace7c8f1Affected
LinuxLinux	4.19Affected before 4.19Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.134 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

4f3c8d6eddc272b386464524235440a418ed2029 to before 959ef329071136e4335b54822fe2f607659b4569Affected
4f3c8d6eddc272b386464524235440a418ed2029 to before e189d443767f7cd390c52f2e122e1fc41c7562d6Affected
4f3c8d6eddc272b386464524235440a418ed2029 to before 7fa8f61bab3fb75b5deba8a0f3abb74dc5068d9fAffected
4f3c8d6eddc272b386464524235440a418ed2029 to before 95e09b07e50290254b28b8395509473104518f8cAffected
4f3c8d6eddc272b386464524235440a418ed2029 to before d13318dec0c1e0e2ac16f8ecbd522db14cea4bb1Affected
4f3c8d6eddc272b386464524235440a418ed2029 to before 977b632db51d231dec0bc571089a5c2402674139Affected
4f3c8d6eddc272b386464524235440a418ed2029 to before d40198de50232e04c14c6e2092e896766c95ea48Affected
4f3c8d6eddc272b386464524235440a418ed2029 to before 8a768552f7a8276fb9e01d49773d2094ace7c8f1Affected

LinuxLinux

4.19Affected
before 4.19Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.134 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.