Skip to main content

Linux Kernel EUVDEUVD-2026-48651

| CVE-2026-64242 HIGH
Double Free (CWE-415)
2026-07-24 Linux GHSA-6mf3-xx2m-8j4w
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local-only trigger via probe error path (AV:L), authenticated low-privilege shell required (PR:L), with full kernel memory access if heap exploitation succeeds (C/I/A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 13, 2026 - 19:46 vuln.today
CVSS changed
Aug 13, 2026 - 17:37 NVD
7.8 (HIGH)
Patch available
Jul 24, 2026 - 17:48 EUVD
CVE Published
Jul 24, 2026 - 15:27 nvd
HIGH 7.8
CVE Published
Jul 24, 2026 - 15:27 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: net2280: Fix double free in probe error path

usb_initialize_gadget() installs gadget_release() as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadget_release() when the gadget device's last reference is dropped.

The probe error path calls net2280_remove(), which tears down the partially initialized device and drops the gadget reference with usb_put_gadget(). Calling kfree(dev) afterwards can free the same object again.

Drop the explicit kfree() and let the gadget device release callback handle the final free. This issue was found by a static analysis tool I am developing.

AnalysisAI

Double free corruption in the Linux kernel's net2280 USB gadget driver probe error path enables local low-privilege users to corrupt kernel heap memory, potentially escalating privileges or triggering a system crash. The flaw affects all Linux kernel stable branches from 5.10 through 7.x prior to their respective patch releases (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, 7.1). Discovered by static analysis rather than active exploitation - no public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware dependency of the affected driver.

Technical ContextAI

The net2280 driver (drivers/usb/gadget/udc/net2280.c) implements support for the PLX/NetChip Technology net2280 USB 2.0 device controller chip. During probe, usb_initialize_gadget() registers gadget_release() as the release callback for the embedded gadget device embedded inside struct net2280, meaning the kernel's reference-counted device framework is responsible for freeing the enclosing struct net2280 when the last reference is dropped. In the probe error path, net2280_remove() tears down the partially initialized device and calls usb_put_gadget(), which drops the reference and fires gadget_release() - freeing the struct net2280 allocation. The subsequent explicit kfree(dev) in the probe error path then attempts to free already-released memory, constituting a CWE-415 double free. This class of bug in the kernel heap can produce use-after-free conditions exploitable for memory corruption. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* encompasses the full Linux kernel source tree from the introducing commit f770fbec4165b1acfabdeadb01ad6008d2c537b5 forward.

RemediationAI

Update the Linux kernel to a patched stable release: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1, depending on the active stable branch. Fix commits are available at the kernel stable tree - representative references include https://git.kernel.org/stable/c/550fa4d071a8c8e53072900869d37ae6abf4999d and https://git.kernel.org/stable/c/71b3391dc81655ff058492f8e9d013b2c6e5747b. Ubuntu users should apply updates per USN-8618-1 at https://ubuntu.com/security/notices/USN-8618-1. Where patching is not immediately possible and systems do not rely on net2280 USB gadget hardware, the module can be blacklisted by adding 'blacklist net2280' to /etc/modprobe.d/blacklist.conf and running depmod - this prevents the driver from loading and eliminates the probe error path entirely; trade-off is that net2280-based USB gadget devices will be non-functional. Additionally, restricting unprivileged users from loading kernel modules (sysctl kernel.modules_disabled=1 after boot, or limiting CAP_SYS_MODULE) reduces the local attack surface more broadly.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Micro 6.2 Fixed
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-48651 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy