Skip to main content

Linux Kernel CVE-2026-64344

| EUVDEUVD-2026-48888 HIGH
Use After Free (CWE-416)
2026-07-25 Linux GHSA-fpmv-m5rr-683w
Privilege Escalation Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Connect or emulate idmouse USB device
  2. Delivery
    Open idmouse device node as low-privilege user
  3. Exploit
    Trigger concurrent USB disconnect
  4. Install
    Race release() against disconnect()
  5. C2
    mutex_unlock() accesses freed driver-data structure
  6. Execute
    Leverage UAF for kernel heap exploitation
  7. Impact
    Escalate to root

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires three concurrent conditions: (1) the idmouse kernel module is loaded, which only occurs when a Siemens/Fujitsu ID Mouse USB fingerprint device is physically connected or the module is loaded manually - it is not loaded by default on systems without matching hardware; (2) the attacker holds low-privilege local access sufficient to open the device node (typically /dev/idmouse0, accessible to users in the input or plugdev group depending on udev rules); and (3) the attacker can trigger a USB disconnect event - either by physically unplugging the device or via kernel USB emulation interfaces - while simultaneously closing the file descriptor. The race window is narrow, adding practical timing complexity. Systems without idmouse hardware present are not exploitable.
Impact

The vendor-supplied CVSS 7.8 vector (AV:L/AC:L/PR:L) reflects local, low-privilege access with high CIA impact, consistent with a kernel use-after-free that could underpin privilege escalation. However, AC:L is arguably optimistic: triggering the race between disconnect() and release() requires precise timing and the physical presence of an idmouse USB device, introducing practical exploitation complexity not fully captured in the score. The EPSS of 0.22% (13th percentile) strongly reinforces low exploitation probability; even a mid-sized municipal IT team in opole should treat this as a routine kernel patch cycle item rather than an emergency response. The absence of a KEV listing and any reported POC further reduces operational urgency. The idmouse driver targets an obsolete fingerprint reader with negligible modern enterprise deployment footprint, meaning real-world attack opportunities are scarce - exploitation is largely limited to an insider or low-privilege attacker with physical or logical USB access on a system running this driver.
Exploit ScenarioDerived

A low-privileged local user opens the idmouse device node (e.g., /dev/idmouse0) while simultaneously arranging for the USB device to be disconnected - physically unplugging it or using USB gadget emulation - racing disconnect() against the release() callback triggered by closing the file descriptor. If the race is won, mutex_unlock() in release() accesses the already-freed driver-data structure, enabling heap-level corruption techniques to escalate to kernel-level (root) privileges. No public exploit code has been reported.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 03, 2026

Use-after-free in the Linux kernel's idmouse USB fingerprint driver allows a low-privileged local attacker to corrupt kernel memory by racing a device disconnect against a file-descriptor release, potentially enabling local privilege escalation to root. The bug stems from mutex_unlock() accessing the freed driver-data structure after the lock is released, a documented non-atomic behavior; the fix introduces a kref reference counter to correctly manage object lifetime. Patches are available across all active stable branches; no active exploitation or public exploit has been reported.

RemediationAI

Upgrade to a fixed stable kernel release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc3, applying the corresponding patch commit from git.kernel.org/stable for your branch. Where immediate kernel upgrade is not feasible, blacklisting the idmouse module eliminates the attack surface entirely: add blacklist idmouse to /etc/modprobe.d/blacklist.conf and run modprobe -r idmouse. The trade-off is that Siemens/Fujitsu ID Mouse USB fingerprint readers will cease to function. Systems that have never connected an idmouse device will not have the module loaded and are not exposed without manual intervention.

Affected VersionsENISA

Linux patch: 6.6.145
Linux 54d2bc068fd21bcb096660938bce7c7265613a24 <ff002c153f9722caece3983cc23dc4d9d4652cb4
Linux 54d2bc068fd21bcb096660938bce7c7265613a24 <54c2b7356b4aeea467f9fb13b85e9e036bc428cb
Linux 54d2bc068fd21bcb096660938bce7c7265613a24 <f62622e947f82a3854a8502d09492ffbdeb252b4
Linux 54d2bc068fd21bcb096660938bce7c7265613a24 <31e75fed8f90cfea9f8285e7ed135b0e452bf872
Linux 2.6.24
Linux 54d2bc068fd21bcb096660938bce7c7265613a24 <60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09
Linux patch: 5.10.261
Linux patch: 6.12.96
Linux patch: 7.2-rc3
Linux 54d2bc068fd21bcb096660938bce7c7265613a24 <8d53b14ad4ccbff6d306b3a39c812303f4a87d41
Linux patch: 5.15.212
Linux patch: 0
Linux patch: 6.18.39
Linux patch: 7.1.4
Linux 54d2bc068fd21bcb096660938bce7c7265613a24 <e88cff5fbaa629f3cab45c8b46f395d62c2eb515
Linux patch: 6.1.178
Linux 54d2bc068fd21bcb096660938bce7c7265613a24 <d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in drivers/usb/misc/idmouse.c, the Linux kernel driver for the Siemens/Fujitsu ID Mouse USB fingerprint reader (cpe:2.3:a:linux:linux:*). CWE-416 (Use After Free) applies: mutex_unlock() is documented as non-atomic - it may internally access the mutex object after the lock is released (upstream commits a51749ab34d9 and 2b9d9e0a9ba0). When a USB disconnect event (disconnect() callback) races with the final release() callback triggered by the last file-descriptor close, the driver-data structure - including its embedded mutex - can be freed while mutex_unlock() is still in flight. The fix replaces direct kfree() calls with kref-based reference counting, ensuring the driver-data object is deallocated only after all users have dropped their references. The vulnerable code path was introduced in Linux 2.6.24 (commit 54d2bc068fd21bcb096660938bce7c7265613a24).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Race-condition trigger requires precise timing and physical USB device presence (AC:H); local low-privilege access to device node required (AV:L, PR:L); no scope change outside kernel.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 6.3 MEDIUM
AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 03, 2026 - 16:07 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

USB: idmouse: fix use-after-free on disconnect race

mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2]

Use a kref to release the driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect().

[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most other sleeping locks, can still use the lock object after it's unlocked")

Executive ViewAI

Why It Matters

The Linux kernel's idmouse USB fingerprint driver contains a use-after-free vulnerability enabling low-privileged local users to escalate to root through memory corruption. Organizations operating shared Linux systems, multi-user hosts, or containerized environments where untrusted users have system access face elevated risk of account compromise and system control loss.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 87% exploitable
Prevalence
Rare
obsolete Siemens fingerprint USB driver, minimal modern enterprise deployment
Data Quality
4 sources
Confidence: Medium
EUVD 🇯🇵JVN NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64344 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/383138 REF https://git.kernel.org/stable/c/31e75fed8f90cfea9f8285e7ed135b0e452bf872 REF https://git.kernel.org/stable/c/54c2b7356b4aeea467f9fb13b85e9e036bc428cb REF https://git.kernel.org/stable/c/60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09 REF https://git.kernel.org/stable/c/8d53b14ad4ccbff6d306b3a39c812303f4a87d41 REF https://git.kernel.org/stable/c/d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4 REF https://git.kernel.org/stable/c/e88cff5fbaa629f3cab45c8b46f395d62c2eb515 REF https://git.kernel.org/stable/c/f62622e947f82a3854a8502d09492ffbdeb252b4 REF https://git.kernel.org/stable/c/ff002c153f9722caece3983cc23dc4d9d4652cb4

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy