CVE-2026-64343

USB: ldusb: fix use-after-free on disconnect race

State: Published
Severity: Not scored
Published: Jul 25, 2026
Updated: Aug 17, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: ldusb: fix use-after-free on disconnect race

mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2]

Use a kref to release the driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect().

[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most other sleeping locks, can still use the lock object after it's unlocked")

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ce0d7d3f575fc1ba6a89c3c651e710355590daff to before fc55923a972e715f9a27187b47d4920709e23d85Affected ce0d7d3f575fc1ba6a89c3c651e710355590daff to before e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69Affected ce0d7d3f575fc1ba6a89c3c651e710355590daff to before af59829e67e11ba2511a9f8e4b9111afc7d1f550Affected ce0d7d3f575fc1ba6a89c3c651e710355590daff to before 02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4Affected ce0d7d3f575fc1ba6a89c3c651e710355590daff to before d8f69404e1d671326f86d378b9f5bfbd56490e9dAffected ce0d7d3f575fc1ba6a89c3c651e710355590daff to before 2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915Affected ce0d7d3f575fc1ba6a89c3c651e710355590daff to before a3e794136ab5e3ad1e7019175a4b837aec86db4bAffected ce0d7d3f575fc1ba6a89c3c651e710355590daff to before 19bdfc7b3c179331eafa423d87e1336f43bbfeb8Affected
LinuxLinux	2.6.26Affected before 2.6.26Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

ce0d7d3f575fc1ba6a89c3c651e710355590daff to before fc55923a972e715f9a27187b47d4920709e23d85Affected
ce0d7d3f575fc1ba6a89c3c651e710355590daff to before e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69Affected
ce0d7d3f575fc1ba6a89c3c651e710355590daff to before af59829e67e11ba2511a9f8e4b9111afc7d1f550Affected
ce0d7d3f575fc1ba6a89c3c651e710355590daff to before 02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4Affected
ce0d7d3f575fc1ba6a89c3c651e710355590daff to before d8f69404e1d671326f86d378b9f5bfbd56490e9dAffected
ce0d7d3f575fc1ba6a89c3c651e710355590daff to before 2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915Affected
ce0d7d3f575fc1ba6a89c3c651e710355590daff to before a3e794136ab5e3ad1e7019175a4b837aec86db4bAffected
ce0d7d3f575fc1ba6a89c3c651e710355590daff to before 19bdfc7b3c179331eafa423d87e1336f43bbfeb8Affected

LinuxLinux

2.6.26Affected
before 2.6.26Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.