Skip to main content

Linux Kernel CVE-2026-64340

| EUVDEUVD-2026-48884 HIGH
Use After Free (CWE-416)
2026-07-25 Linux GHSA-p757-fg2x-77h8
Privilege Escalation Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition exploitation requires precise timing between disconnect() and release(), warranting AC:H; local authenticated user is the minimum privilege (PR:L, AV:L); UAF in kernel can yield full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.3 MEDIUM
AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 03, 2026 - 16:40 vuln.today
tag: Information Disclosure replaced by Privilege Escalation
Analysis Generated
Sep 03, 2026 - 16:09 vuln.today
CVSS changed
Sep 03, 2026 - 16:07 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

USB: legousbtower: fix use-after-free on disconnect race

mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2]

Use a kref to release the driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect().

[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most other sleeping locks, can still use the lock object after it's unlocked")

AnalysisAI

The Linux kernel's legousbtower USB driver contains a use-after-free race condition between the release() and disconnect() code paths, present since Linux 2.6.25. An authenticated local user with a LEGO USB Tower device attached can trigger the race at disconnect time to corrupt freed kernel memory, potentially gaining elevated privileges or crashing the system. Patches have been issued across all active stable branches (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1); no public exploit code or CISA KEV listing exists at time of analysis.

Technical ContextAI

The legousbtower driver (drivers/usb/misc/legousbtower.c) manages the LEGO USB Tower peripheral originally used with LEGO Mindstorms. The flaw (CWE-416: Use After Free) arises from the documented non-atomic behavior of mutex_unlock(): per kernel commit a51749ab34d9, mutex_unlock() may continue accessing the mutex structure after releasing the lock, meaning the underlying object must still be valid at that moment. When a USB device is physically disconnected while a userspace process still holds the file descriptor open, the disconnect() callback and the release() file-operation race. Because mutex_unlock() does not provide object lifetime guarantees, the driver data structure can be freed while mutex_unlock() is still referencing it. The fix replaces direct lifetime management with a kref (kernel reference counter), which atomically tracks outstanding users of the driver data and defers the final kfree() until all users have dropped their reference, eliminating the use-after-free window. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* identifies the upstream kernel codebase across all affected versions.

RemediationAI

The primary fix is to upgrade to a patched stable kernel release matching the active series in use: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, or 7.1.4, with 7.2-rc3 containing the fix for the development branch. Individual fix commits can be reviewed and cherry-picked from the kernel stable repository links provided in the references. As a compensating control where immediate kernel update is not feasible, administrators can prevent the vulnerable code path from loading by blacklisting the legousbtower module via adding 'blacklist legousbtower' to /etc/modprobe.d/blacklist.conf and running depmod; this has no operational side effect unless LEGO USB Tower devices are genuinely in active use. Restricting physical USB port access to authorized personnel also removes the hardware prerequisite required for exploitation.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

CVE-2026-64340 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy