Skip to main content

Linux Kernel CVE-2026-64338

| EUVDEUVD-2026-48882 MEDIUM
2026-07-25 Linux GHSA-pghr-8xhx-xv5x
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local trigger via USB hotplug requires low-privilege access (AV:L/PR:L); only availability is affected via potential kernel crash (A:H), with no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.6 MEDIUM
AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 03, 2026 - 16:40 vuln.today
tag: Information Disclosure replaced by Denial Of Service
Analysis Generated
Sep 03, 2026 - 16:22 vuln.today
CVSS changed
Sep 03, 2026 - 16:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

USB: misc: uss720: unregister parport on probe failure

uss720_probe() registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002 adapters. If get_1284_register() fails, the error path drops the driver private data and the USB device reference, but leaves the parport device registered.

Leaving the port registered is more than a private allocation leak: parport_register_port() has already reserved a parport number and registered the parport bus device, while pp->private_data still points at the private data that the common error path is about to release.

Undo the pre-announce registration in the get_1284_register() failure branch before jumping to the common private-data cleanup path. Clear priv->pp first, matching the disconnect path and avoiding a stale pointer in the private data.

This issue was identified during our ongoing static-analysis research while reviewing kernel code.

AnalysisAI

Incomplete error-path cleanup in the Linux kernel's uss720 USB-to-parallel-port driver leaves a parport device registered after probe failure, creating a dangling stale pointer backed by freed private data. Systems where a Belkin F5U002 or similar USS720-based adapter is attached and causes get_1284_register() to fail during uss720_probe() are left with an orphaned kernel parport entry and a reserved parport slot, which can lead to a kernel crash when the stale pp->private_data pointer is later dereferenced. No active exploitation has been identified; the bug was discovered via static-analysis research, and patches are available across all major Linux stable branches.

Technical ContextAI

The uss720 driver (drivers/usb/misc/uss720.c) provides Linux kernel support for USB-to-IEEE-1284 parallel-port adapters. During USB hotplug, uss720_probe() calls parport_register_port() to reserve a parport number and register the parport bus device before invoking get_1284_register() to detect unsupported adapters such as the Belkin F5U002. If get_1284_register() returns an error, the existing error path correctly frees the driver's private data structure and drops the USB device reference, but omits the corresponding parport_unregister_port() call. This leaves pp->private_data pointing to already-freed kernel memory - a classic stale/dangling pointer condition analogous to CWE-459 (Incomplete Cleanup) or CWE-672 (Operation on Resource After Expiration or Release), though no formal CWE is assigned. The registered parport device retains its bus registration and parport number reservation despite the underlying resources having been released. The affected CPE is the Linux kernel broadly (cpe:2.3:a:linux:linux:*), and the flaw spans numerous stable branches from 4.19.x through 7.x.

RemediationAI

Upgrade to a patched Linux kernel stable release. Confirmed fix versions from upstream stable include 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc3. Upstream fix commits are available at git.kernel.org via the stable references in this CVE (e.g., https://git.kernel.org/stable/c/6bbb98bec71b577fda4f4b48f7aea5874b04a576). Apply distribution-specific kernel updates from Debian, Ubuntu, Red Hat, SUSE, and other vendors as they are released. As a compensating control for systems that do not use USB-to-parallel-port adapters, blacklist the uss720 module by adding 'blacklist uss720' to /etc/modprobe.d/blacklist.conf and regenerating the initramfs (update-initramfs -u on Debian/Ubuntu; dracut -f on RHEL/SUSE). This has no functional side effect on machines without such adapters. Additionally, restricting physical USB port access or applying udev rules to prevent uss720 device attachment can limit exposure in shared or managed environments.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

CVE-2026-64338 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy