Skip to main content

Linux Kernel CVE-2026-64345

| EUVDEUVD-2026-48889 MEDIUM
2026-07-25 Linux GHSA-j7g9-89xm-vfhf
Linux
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Gain local unprivileged shell
  2. Delivery
    Confirm f_printer gadget driver is loaded
  3. Exploit
    Access /dev/g_printer character device
  4. Install
    Open device once to set EBUSY state
  5. C2
    Loop repeated open() calls triggering kref leak
  6. Execute
    Reference counter exhausted
  7. Impact
    Driver teardown blocked, availability lost

Vulnerability Assessment

Exploitation Conditions

Requires local, low-privilege access (PR:L, AV:L) to the system. The f_printer USB gadget function driver must be loaded - this is non-default and only present on devices configured to operate as USB gadget peripherals (e.g., embedded Linux SBCs, custom USB devices). The character device node must be accessible to the attacker. Exploitation is limited to availability impact only (C:N/I:N); there is no data disclosure or privilege escalation path. The counter leak only accumulates under repeated failed open attempts, making unintentional triggering unlikely.
Impact

Real-world risk is low despite the A:H CVSS impact rating. EPSS of 0.21% (12th percentile) confirms negligible community-observed exploitation probability. The vulnerability is not in CISA KEV, and no POC code has been identified. Exploitation requires local access (AV:L) and at minimum low-privilege credentials to open the character device node (PR:L). Critically, the f_printer gadget must be compiled and loaded, and the device must be operating in USB gadget mode - a non-default deployment scenario primarily found in embedded Linux systems. The impact is purely availability: a persistent reference leak that accumulates only under repeated failed open attempts. This is a maintenance/stability defect rather than a security-critical exploit path. The CVSS A:H reflects theoretical complete unavailability, but in practice exploitation would require sustained, deliberate effort to wrap the reference counter. The 'Information Disclosure' tag in the input is incorrect - there is no confidentiality impact (C:N confirmed by CVSS vector).
Exploit ScenarioDerived

A local user with access to the f_printer character device opens it once (succeeding), then continuously attempts to open it a second time in a tight loop; each attempt returns -EBUSY but increments the reference count. After millions of iterations, the reference counter overflows or driver teardown is permanently blocked, causing the USB gadget subsystem to become unresponsive and requiring a reboot. No POC has been identified.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 03, 2026

Reference count leak in the Linux kernel USB gadget printer driver (f_printer) allows a local user to trigger a permanent kref increment on every rejected concurrent open attempt. Each call to printer_open() that returns -EBUSY still increments dev->kref, but because VFS never invokes ->release() for a failed open, the reference is never balanced. Repeated exploitation exhausts the reference counter, preventing proper driver teardown and causing availability degradation. No public exploit has been identified at time of analysis.

RemediationAI

Apply the upstream kernel fix that moves kref_get() into the successful-open branch of printer_open(). Stable-series patches are available via the kernel.org stable tree at the following commits: 94ec20d97aa5 (one stable branch), 8a5eba992c86 (another), bf20c94fa6aa, 75c0ad13e136, 7f1f24c36793, and 30adce93d5c4 - all referenced at https://git.kernel.org/stable/c/. Distributions should apply the corresponding stable kernel update for their deployed branch. As a compensating control where patching is not immediately possible, preventing untrusted local users from accessing the f_printer character device node (typically /dev/g_printer*) via filesystem permissions or udev rules eliminates the attack surface entirely, with no functional impact for environments not relying on USB gadget printing. Alternatively, unloading or blacklisting the g_printer or usb_f_printer kernel module removes the driver from the attack surface.

Affected VersionsENISA

Linux 5.8.17 <5.9
Linux 5.10
Linux e8d5f92b8d30bb4ade76494490c3c065e12411b1 <8a5eba992c862b0c94411eecf9b7121e8636db38
Linux e8d5f92b8d30bb4ade76494490c3c065e12411b1 <94ec20d97aa51547965a539f660a1fe79c6929a3
Linux e8d5f92b8d30bb4ade76494490c3c065e12411b1 <bf20c94fa6aaff945f0ae3a23f3212cd299f28d9
Linux 4.19.154 <4.20
Linux patch: 0
Linux 4.9.241 <4.10
Linux e8d5f92b8d30bb4ade76494490c3c065e12411b1 <75c0ad13e136961328253742501b4efc3988a587
Linux patch: 7.2-rc3
Linux patch: 6.18.39
Linux e8d5f92b8d30bb4ade76494490c3c065e12411b1 <30adce93d5c4a5a1ec29d9249e3fdfcc391d406b
Linux 5.9.2 <5.10
Linux patch: 7.1.4
Linux e8d5f92b8d30bb4ade76494490c3c065e12411b1 <7f1f24c367938c5537e2308bf9a965f051d14774
Linux patch: 6.6.145
Linux 4a47581cf010dc351d8069978080fdb000c0776d
Linux d9fe88b2a38dc700bf5bd3a09c7cd11bbc248367
Linux 5.4.73 <5.5
Linux 34f026263889e2827e04acdc3a0eb9ecbd191ef0
Linux e9e791f5c39ab30e374a3b1a9c25ca7ff24988f3
Linux 4.4.241 <4.5
Linux 25c95c6bd4dc50a3c20de0fa7f450ea02b2320fc
Linux 4.14.203 <4.15
Linux cedb0187b8ba929c3f76f28e6bc25804d65f8a54
Linux patch: 6.12.96
Linux patch: 5.10.261
Linux 5f845e5d18d151230476cf90aa46449f69ba2ef1

Affected Packages

euvd linux fix: 4.5, 4.10, 4.15, 4.20, 5.5, 5.9, 5.10

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The f_printer component is a USB gadget function driver in the Linux kernel that allows a Linux device to present itself as a USB printer to a connected host. It manages access to the underlying character device through a kref (kernel reference counter, struct kref) that tracks open handles for lifecycle management. The root cause is a reference-counting error: kref_get() is called unconditionally in printer_open() before the -EBUSY early-return check for an already-open device. Because the VFS layer only calls the ->release() file operation on successful opens, every rejected open permanently leaks one reference unit. CWE classification is not assigned in the input, but this maps closely to CWE-911 (Improper Update of Reference Count) or CWE-772 (Missing Release of Resource after Effective Lifetime). Affected CPE is cpe:2.3:a:linux:linux:*.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local access required to reach char device (AV:L), low privilege to open it (PR:L), no confidentiality or integrity impact - only availability via reference leak.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 03, 2026 - 16:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_printer: take kref only for successful open

printer_open() returns -EBUSY when the character device is already open, but it increments dev->kref regardless of the return value. VFS does not call ->release() for a failed open, so every rejected second open permanently leaks one reference.

Move kref_get() into the successful-open branch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 88% exploitable
Prevalence
Low
niche USB gadget mode, non-default Linux kernel config
Data Quality
6 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Vendor StatusVendor

SUSE

Severity: Low
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.8.150 Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.193 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.169 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.223 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.167 Affected
Image SLES-GCE-3P Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64345 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/383143 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23066/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23068/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23183/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23193/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23194/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23221/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23231/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23237/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23238/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23240/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23241/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23244/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3790/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3810/ REF https://git.kernel.org/stable/c/30adce93d5c4a5a1ec29d9249e3fdfcc391d406b REF https://git.kernel.org/stable/c/75c0ad13e136961328253742501b4efc3988a587 REF https://git.kernel.org/stable/c/7f1f24c367938c5537e2308bf9a965f051d14774 REF https://git.kernel.org/stable/c/8a5eba992c862b0c94411eecf9b7121e8636db38 REF https://git.kernel.org/stable/c/94ec20d97aa51547965a539f660a1fe79c6929a3 REF https://git.kernel.org/stable/c/a12d81a9cc2a012a24ecb7f9ba076b9f7c179bd3 REF https://git.kernel.org/stable/c/bf20c94fa6aaff945f0ae3a23f3212cd299f28d9

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy