CVE-2026-64242

usb: gadget: net2280: Fix double free in probe error path

State: Published
Severity: Not scored
Published: Jul 24, 2026
Updated: Jul 24, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: net2280: Fix double free in probe error path

usb_initialize_gadget() installs gadget_release() as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadget_release() when the gadget device's last reference is dropped.

The probe error path calls net2280_remove(), which tears down the partially initialized device and drops the gadget reference with usb_put_gadget(). Calling kfree(dev) afterwards can free the same object again.

Drop the explicit kfree() and let the gadget device release callback handle the final free. This issue was found by a static analysis tool I am developing.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before 71b3391dc81655ff058492f8e9d013b2c6e5747bAffected f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before 550fa4d071a8c8e53072900869d37ae6abf4999dAffected f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before c5b9fdb1e8ddf50bc6272927edb118679f170350Affected f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before 085652fda7f38040d1a2c42d72614f418feb843fAffected f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before 48f89ead20e48d447ad29fa937b43b9fa981cf28Affected f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before e6f8be12f0307145b9a6010f044925952b37de8bAffected f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before db2b72e83a0208ae2b3b270bf91662b1c6849a9bAffected f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before c8547c74988e0b5f4cbb1b895e2a57aae084f070Affected
LinuxLinux	5.10Affected before 5.10Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before 71b3391dc81655ff058492f8e9d013b2c6e5747bAffected
f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before 550fa4d071a8c8e53072900869d37ae6abf4999dAffected
f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before c5b9fdb1e8ddf50bc6272927edb118679f170350Affected
f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before 085652fda7f38040d1a2c42d72614f418feb843fAffected
f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before 48f89ead20e48d447ad29fa937b43b9fa981cf28Affected
f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before e6f8be12f0307145b9a6010f044925952b37de8bAffected
f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before db2b72e83a0208ae2b3b270bf91662b1c6849a9bAffected
f770fbec4165b1acfabdeadb01ad6008d2c537b5 to before c8547c74988e0b5f4cbb1b895e2a57aae084f070Affected

LinuxLinux

5.10Affected
before 5.10Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.