CVE-2026-64340

USB: legousbtower: fix use-after-free on disconnect race

Published Jul 25, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

USB: legousbtower: fix use-after-free on disconnect race

mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]

Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().

[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`18bcbcfe9ca2308ebffb40068b51803da9315d97`	affected	< 11d069f85851997b4ea0adf242ed9672dc749b8f
`18bcbcfe9ca2308ebffb40068b51803da9315d97`	affected	< b4222c05066b252b451f9c8c4730b5b60824ea66
`18bcbcfe9ca2308ebffb40068b51803da9315d97`	affected	< 6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee
`18bcbcfe9ca2308ebffb40068b51803da9315d97`	affected	< 0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e
`18bcbcfe9ca2308ebffb40068b51803da9315d97`	affected	< ab2bfd7bec4f134b377ec42f513e90c35db94160
`18bcbcfe9ca2308ebffb40068b51803da9315d97`	affected	< 766738ecf2b819e54d38763c8d1c8ae6cff14b39
`18bcbcfe9ca2308ebffb40068b51803da9315d97`	affected	< 9ba62966461a8e3cc593b62c56ec62eb2d80436d
`18bcbcfe9ca2308ebffb40068b51803da9315d97`	affected	< 62fc8eb1b1481051f7bab4aa93d79809053dd09f

Linux

affected

Version	Status	Constraints
`2.6.25`	affected	—
`0`	unaffected	< 2.6.25
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.2:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.2:rc2::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[18bcbcfe9ca2308ebffb40068b51803da9315d97,11d069f85851997b4ea0adf242ed9672dc749b8f)`	affected	code_commit	—
`[18bcbcfe9ca2308ebffb40068b51803da9315d97,b4222c05066b252b451f9c8c4730b5b60824ea66)`	affected	code_commit	—
`[18bcbcfe9ca2308ebffb40068b51803da9315d97,6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee)`	affected	code_commit	—
`[18bcbcfe9ca2308ebffb40068b51803da9315d97,0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e)`	affected	code_commit	—
`[18bcbcfe9ca2308ebffb40068b51803da9315d97,ab2bfd7bec4f134b377ec42f513e90c35db94160)`	affected	code_commit	—
`[18bcbcfe9ca2308ebffb40068b51803da9315d97,766738ecf2b819e54d38763c8d1c8ae6cff14b39)`	affected	code_commit	—
`[18bcbcfe9ca2308ebffb40068b51803da9315d97,9ba62966461a8e3cc593b62c56ec62eb2d80436d)`	affected	code_commit	—
`[18bcbcfe9ca2308ebffb40068b51803da9315d97,62fc8eb1b1481051f7bab4aa93d79809053dd09f)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`2.6.25`	affected	semver	—
`[0,2.6.25)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Ubuntu USN	USN-8726-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8727-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8760-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8726-3	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8800-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8760-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8876-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.126% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e
https://git.kernel.org/stable/c/11d069f85851997b4ea0adf242ed9672dc749b8f
https://git.kernel.org/stable/c/62fc8eb1b1481051f7bab4aa93d79809053dd09f
https://git.kernel.org/stable/c/6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee
https://git.kernel.org/stable/c/766738ecf2b819e54d38763c8d1c8ae6cff14b39
https://git.kernel.org/stable/c/9ba62966461a8e3cc593b62c56ec62eb2d80436d
https://git.kernel.org/stable/c/ab2bfd7bec4f134b377ec42f513e90c35db94160
https://git.kernel.org/stable/c/b4222c05066b252b451f9c8c4730b5b60824ea66
https://lore.kernel.org/linux-cve-announce/2026072515-CVE-2026-64340-1720@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64340
https://www.cve.org/CVERecord?id=CVE-2026-64340

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 3, 2026 4:15 PM Weaknesses updated. Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416
CPEs		cpe:2.3:o:linux:linux_kernel:7.2:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.2:rc2::::::
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Aug 3, 2026 7:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Jul 30, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-364
References		https://lore.kernel.org/linux-cve-announce/2026072515-CVE-2026-64340-1720@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64340 https://www.cve.org/CVERecord?id=CVE-2026-64340
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Jul 28, 2026 4:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Jul 25, 2026 9:30 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: USB: legousbtower: fix use-after-free on disconnect race mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2] Use a kref to release the driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect(). [1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most other sleeping locks, can still use the lock object after it's unlocked")
Title		USB: legousbtower: fix use-after-free on disconnect race
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e https://git.kernel.org/stable/c/11d069f85851997b4ea0adf242ed9672dc749b8f https://git.kernel.org/stable/c/62fc8eb1b1481051f7bab4aa93d79809053dd09f https://git.kernel.org/stable/c/6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee https://git.kernel.org/stable/c/766738ecf2b819e54d38763c8d1c8ae6cff14b39 https://git.kernel.org/stable/c/9ba62966461a8e3cc593b62c56ec62eb2d80436d https://git.kernel.org/stable/c/ab2bfd7bec4f134b377ec42f513e90c35db94160 https://git.kernel.org/stable/c/b4222c05066b252b451f9c8c4730b5b60824ea66