What is the CVSS score of CVE-2026-64453?

CVE-2026-64453 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-64453?

Within 24 hours, identify all Linux systems running kernel versions prior to 6.18.39, 7.1.4, or 7.2-rc3 and assess their role in your environment. Within 7 days, apply vendor-released patches to all affected systems via standard kernel update mechanisms-specifically upgrade to Linux stable branches 6.18.39, 7.1.4, or 7.2-rc3 or later depending on your current branch. Within 30 days, complete full remediation across all infrastructure, conduct post-patch verification of USB device functionality, and update your incident response procedures to reflect this attack vector requiring only local access.

Linux Kernel CVE-2026-64453

EUVD-2026-48797 HIGH

Use After Free (CWE-416)

2026-07-25 Linux

GHSA-5f44-jrgv-8f7h

Privilege Escalation Linux Use After Free Memory Corruption Red Hat Suse

7.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Gain local low-privileged shell on target
Delivery

Confirm usbio driver loaded (lsmod)
Exploit

Trigger USB device disconnect or unbind
Install

usbio_disconnect() iterates freed client via stale list pointer
C2

Kernel slab UAF dereference
Execute

Heap-groom to control freed region
Impact

Escalate to root privileges

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires: (1) local, low-privileged account on the target Linux system; (2) the usbio kernel module must be loaded, which only occurs when a supported USB I/O bridge device is attached or the module is explicitly loaded; (3) the attacker must be able to trigger a USB disconnect event - either by physical access to remove the device, or (less commonly) by software-triggering an unbind on the USB interface through sysfs, which typically requires elevated privilege or a permissive udev/USB policy. Systems without usbio-class USB peripherals will never load the driver and are not exposed. The path runs entirely within the kernel workqueue (hub_event/process_one_work) during device teardown, so no network access is required and no user interaction beyond the disconnect event is necessary.
Impact	The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) is well-calibrated for a local kernel UAF. Attack vector is local, reflecting that the vulnerable code path is reached only when a usbio-class USB device is physically disconnected or its driver detached - not remotely triggerable. PR:L is appropriate; standard unprivileged users who can trigger USB events (e.g., by owning or accessing the device node) can reach this path. The high C/I/A ratings reflect that kernel slab UAFs, if reliably exploited, enable arbitrary kernel memory manipulation and privilege escalation to root. EPSS at 0.21% (11th percentile) reflects the niche attack surface - the usbio driver is not present in most production Linux deployments. No CISA KEV listing and no public POC further lower operational urgency. Real-world risk is moderate: the precondition of having a usbio USB bridge device connected significantly narrows the exposed population, but any Linux system serving as a USB peripheral hub or embedded gateway with this driver loaded should treat the patch as high priority given the kernel-level impact.
Exploit ScenarioDerived	An attacker with local low-privileged access on a Linux system connected to a USB I/O bridge device running the usbio driver physically removes (or programmatically unbinds) the USB device. During disconnect cleanup, the kernel iterates the freed client list and dereferences the freed slab object, triggering the UAF. A sufficiently sophisticated attacker could heap-groom the slab allocator to place attacker-controlled data where the freed usbio_client previously lived, redirecting kernel control flow to achieve privilege escalation to root. No public POC is available at time of analysis, but the KASAN trace fully documents the crash site.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 03, 2026

Use-after-free in the Linux kernel's usbio (USB I/O bridge) driver allows a local, low-privileged attacker to corrupt kernel slab memory during USB device disconnect, potentially achieving privilege escalation or triggering a kernel panic. The bug lies in usbio_disconnect(), which iterates the client list in reverse using list_for_each_entry_reverse() - a macro that reads client->link.prev after the loop body, but auxiliary_device_uninit() can free the current client before that read, dereferencing freed slab memory. Patches are confirmed in Linux stable branches 6.18.39, 7.1.4, and 7.2-rc3; no public exploit or active exploitation is identified at time of analysis.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 6.18.39 or later, 7.1.4 or later, or 7.2-rc3 or later. The upstream fix commits are available at https://git.kernel.org/stable/c/0bfeec21984fedd32987f4e4c0cde34b445af404 (6.x stable), https://git.kernel.org/stable/c/1947b6411460d68b54b13c536961933166937d05 (7.1.x stable), and https://git.kernel.org/stable/c/c40090f8d19b415e2925b22be964b5d1f695666f (mainline/7.2-rc3). For systems that cannot immediately patch, a targeted compensating control is to prevent loading of the usbio kernel module via a modprobe deny rule (install usbio /bin/false in /etc/modprobe.d/), or to enforce USB device authorization policies so usbio-class devices cannot be attached by unprivileged users. Note that disabling the module will also disable any attached USB I/O bridge peripherals that depend on it. Linux distribution vendors (Debian, RHEL, Ubuntu, SUSE) will backport these fixes into their kernel packages; check distribution security advisories for exact package versions.

Affected VersionsENISA

Linux patch: 7.2-rc3

Linux patch: 0

Linux patch: 7.1.4

Linux 121a0f839dbb397af5fabb701cea3e9983223e50 <1947b6411460d68b54b13c536961933166937d05

Linux 121a0f839dbb397af5fabb701cea3e9983223e50 <c40090f8d19b415e2925b22be964b5d1f695666f

Linux patch: 6.18.39

Linux 121a0f839dbb397af5fabb701cea3e9983223e50 <0bfeec21984fedd32987f4e4c0cde34b445af404

Linux 6.18

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The usbio driver (drivers/usb/misc/usbio/) implements a USB auxiliary bus for I/O bridge peripherals. During disconnect, usbio_disconnect() iterates usbio->cli_list in reverse via list_for_each_entry_reverse() to uninitialize auxiliary devices. The problem is that auxiliary_device_uninit() drops the device reference, and for unbound children this invokes usbio_auxdev_release(), freeing the enclosing struct usbio_client. The list macro then attempts to advance the iterator by reading the now-freed client->link.prev field - a classic CWE-416 use-after-free in kernel slab memory, confirmed by the KASAN report: 'BUG: KASAN: slab-use-after-free in usbio_disconnect+0x12e/0x150'. The fix replaces list_for_each_entry_reverse() with list_for_each_entry_safe_reverse(), which caches the prev pointer before the loop body executes, decoupling iterator advancement from client lifetime. CPE: cpe:2.3:a:linux:linux (kernel source tree).

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

Local vector (AV:L) because disconnect is triggered locally; PR:L for unprivileged user with USB device access; all three impacts high for kernel UAF exploitation potential.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 03, 2026 - 14:52 NVD

7.8 (HIGH)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:51 nvd

HIGH 7.8

CVE Published

Jul 25, 2026 - 08:51 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usb: misc: usbio: fix disconnect UAF in client teardown

usbio_disconnect() walks usbio->cli_list in reverse and uninitializes each auxiliary device. auxiliary_device_uninit() drops the device reference, and for an unbound child that can run usbio_auxdev_release() and free the containing struct usbio_client.

list_for_each_entry_reverse() advances after the loop body by reading client->link.prev. If the current client is freed by auxiliary_device_uninit(), the iterator dereferences freed memory.

Use list_for_each_entry_safe_reverse() so the previous client is cached before the body can drop the final reference. This preserves reverse teardown order while keeping the next iterator cursor independent of the current client's lifetime.

Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in usbio_disconnect+0x12e/0x150

Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 ? usbio_disconnect+0x12e/0x150 ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x188/0x320 ? usbio_disconnect+0x12e/0x150 kasan_report+0xe0/0x110 ? usbio_disconnect+0x12e/0x150 usbio_disconnect+0x12e/0x150 usb_unbind_interface+0xf3/0x400 really_probe+0x316/0x660 __driver_probe_device+0x106/0x240 driver_probe_device+0x4a/0x110 __device_attach_driver+0xf1/0x1a0 ? __pfx___device_attach_driver+0x10/0x10 bus_for_each_drv+0xf9/0x160 ? __pfx_bus_for_each_drv+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? trace_hardirqs_on+0x18/0x130 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __device_attach+0x133/0x2a0 ? __pfx___device_attach+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_raw_spin_unlock+0x9a/0x100 ? srso_alias_return_thunk+0x5/0xfbef5 device_initial_probe+0x55/0x70 bus_probe_device+0x4a/0xd0 device_add+0x9b9/0xc10 ? __pfx_device_add+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x44/0x60 ? srso_alias_return_thunk+0x5/0xfbef5 ? lockdep_hardirqs_on_prepare+0xea/0x1a0 ? srso_alias_return_thunk+0x5/0xfbef5 ? usb_enable_lpm+0x3c/0x260 usb_set_configuration+0xb64/0xf20 usb_generic_driver_probe+0x5f/0x90 usb_probe_device+0x71/0x1b0 really_probe+0x46b/0x660 __driver_probe_device+0x106/0x240 driver_probe_device+0x4a/0x110 __device_attach_driver+0xf1/0x1a0 ? __pfx___device_attach_driver+0x10/0x10 bus_for_each_drv+0xf9/0x160 ? __pfx_bus_for_each_drv+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? trace_hardirqs_on+0x18/0x130 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __device_attach+0x133/0x2a0 ? __pfx___device_attach+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_raw_spin_unlock+0x9a/0x100 ? srso_alias_return_thunk+0x5/0xfbef5 device_initial_probe+0x55/0x70 bus_probe_device+0x4a/0xd0 device_add+0x9b9/0xc10 ? __pfx_device_add+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? add_device_randomness+0xb7/0xf0 usb_new_device+0x492/0x870 hub_event+0x1b10/0x29c0 ? __pfx_hub_event+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_acquire+0x187/0x300 ? process_one_work+0x475/0xb90 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_release+0xc8/0x290 ? srso_alias_return_thunk+0x5/0xfbef5 process_one_work+0x4d7/0xb90 ? __pfx_process_one_work+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __list_add_valid_or_report+0x37/0xf0 ? __pfx_hub_event+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 worker_thread+0x2d8/0x570 ? __pfx_worker_thread+0x10/0x10 kthread+0x1ad/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3c9/0x540 ? __pfx_ret_from_fork+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __switch_to+0x2e9/0x730 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>

Executive ViewAI

Why It Matters

A use-after-free vulnerability in the Linux kernel's usbio (USB I/O bridge) driver allows local, low-privileged users to corrupt kernel memory during USB device disconnection, enabling privilege escalation to root or triggering kernel panics. Organizations running unpatched Linux systems with active USB device management face risk of unauthorized system compromise or service disruption. Remediation requires updating to patched kernel versions across affected infrastructure.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Prevalence

Medium

Linux kernel ubiquitous but usbio driver niche, specialized USB bridge hardware only

Data Quality

4 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Privilege Escalation

View all

CVE-2024-0012 CRITICAL POC

9.3

CVE-2025-47812 CRITICAL POC

10.0

CVE-2013-0422 CRITICAL POC

9.8

CVE-2013-0632 CRITICAL POC

9.8

CVE-2024-9474 MEDIUM POC

6.9

CVE-2017-5689 CRITICAL POC

9.8

CVE-2021-20021 CRITICAL POC

9.8

CVE-2017-12635 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64453 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/383243 REF https://git.kernel.org/stable/c/0bfeec21984fedd32987f4e4c0cde34b445af404 REF https://git.kernel.org/stable/c/1947b6411460d68b54b13c536961933166937d05 REF https://git.kernel.org/stable/c/c40090f8d19b415e2925b22be964b5d1f695666f

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back