Skip to main content

Linux Kernel EUVDEUVD-2026-48884

| CVE-2026-64340 HIGH
Use After Free (CWE-416)
2026-07-25 Linux GHSA-p757-fg2x-77h8
Privilege Escalation Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Authenticate as local user
  2. Delivery
    Connect LEGO USB Tower to system
  3. Exploit
    Open device file descriptor
  4. Install
    Initiate USB disconnect while holding fd
  5. C2
    Race disconnect() against release()
  6. Execute
    Trigger UAF in mutex_unlock()
  7. Impact
    Corrupt kernel memory for privilege escalation

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires all three of the following: (1) the legousbtower kernel module must be loaded - this occurs only when a physical LEGO USB Tower device (the legacy LEGO Mindstorms IR Tower, circa 2000s) is connected or the module is explicitly pre-loaded, as it is not auto-loaded without hardware; (2) the attacker must have local authenticated access (PR:L) with permission to open the /dev/usb/legousbtower0 device node; and (3) the attacker must be able to trigger or simulate disconnection of the USB device while a concurrent release() is in progress, requiring precise timing to win the race window. Systems lacking LEGO USB Tower hardware or with the legousbtower module blacklisted are entirely unaffected. Remote unauthenticated exploitation is not possible.
Impact

Real-world risk is substantially lower than the raw CVSS 7.8 score implies. The attack vector is strictly local (AV:L) with a required authenticated user (PR:L), and - critically - a physical LEGO USB Tower device must be connected to the target machine. This obsolete LEGO Mindstorms accessory has essentially no presence in modern production environments; even a mid-sized municipal IT team in koszalin would be unlikely to have this peripheral plugged into any server or workstation, making opportunistic exploitation effectively nil. The EPSS score of 0.22% at the 13th percentile corroborates this low real-world interest. Triggering the race between release() and disconnect() also demands precise timing, adding practical exploitation difficulty beyond what AC:L in the vendor-provided CVSS suggests. The absence of any KEV listing, public POC, or exploitation reports further reduces urgency. Defenders should apply the relevant stable kernel update as part of routine patching cycles but need not treat this as a high-priority emergency.
Exploit ScenarioDerived

A local authenticated user on a Linux system with a LEGO USB Tower physically connected opens the /dev/usb/legousbtower0 device file, then simultaneously disconnects the USB device while the file handle is being closed. If the timing of disconnect() and release() races correctly, mutex_unlock() references already-freed driver data, producing a use-after-free that can be leveraged for kernel memory corruption or local privilege escalation. No public proof-of-concept exploit code has been identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 03, 2026

The Linux kernel's legousbtower USB driver contains a use-after-free race condition between the release() and disconnect() code paths, present since Linux 2.6.25. An authenticated local user with a LEGO USB Tower device attached can trigger the race at disconnect time to corrupt freed kernel memory, potentially gaining elevated privileges or crashing the system. Patches have been issued across all active stable branches (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1); no public exploit code or CISA KEV listing exists at time of analysis.

RemediationAI

The primary fix is to upgrade to a patched stable kernel release matching the active series in use: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, or 7.1.4, with 7.2-rc3 containing the fix for the development branch. Individual fix commits can be reviewed and cherry-picked from the kernel stable repository links provided in the references. As a compensating control where immediate kernel update is not feasible, administrators can prevent the vulnerable code path from loading by blacklisting the legousbtower module via adding 'blacklist legousbtower' to /etc/modprobe.d/blacklist.conf and running depmod; this has no operational side effect unless LEGO USB Tower devices are genuinely in active use. Restricting physical USB port access to authorized personnel also removes the hardware prerequisite required for exploitation.

Affected VersionsENISA

Linux 18bcbcfe9ca2308ebffb40068b51803da9315d97 <9ba62966461a8e3cc593b62c56ec62eb2d80436d
Linux patch: 7.1.4
Linux patch: 6.1.178
Linux 18bcbcfe9ca2308ebffb40068b51803da9315d97 <766738ecf2b819e54d38763c8d1c8ae6cff14b39
Linux patch: 5.15.212
Linux 18bcbcfe9ca2308ebffb40068b51803da9315d97 <ab2bfd7bec4f134b377ec42f513e90c35db94160
Linux 18bcbcfe9ca2308ebffb40068b51803da9315d97 <11d069f85851997b4ea0adf242ed9672dc749b8f
Linux 18bcbcfe9ca2308ebffb40068b51803da9315d97 <6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee
Linux 18bcbcfe9ca2308ebffb40068b51803da9315d97 <62fc8eb1b1481051f7bab4aa93d79809053dd09f
Linux patch: 6.6.145
Linux patch: 7.2-rc3
Linux patch: 0
Linux patch: 6.12.96
Linux 18bcbcfe9ca2308ebffb40068b51803da9315d97 <0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e
Linux 18bcbcfe9ca2308ebffb40068b51803da9315d97 <b4222c05066b252b451f9c8c4730b5b60824ea66
Linux 2.6.25
Linux patch: 5.10.261
Linux patch: 6.18.39

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The legousbtower driver (drivers/usb/misc/legousbtower.c) manages the LEGO USB Tower peripheral originally used with LEGO Mindstorms. The flaw (CWE-416: Use After Free) arises from the documented non-atomic behavior of mutex_unlock(): per kernel commit a51749ab34d9, mutex_unlock() may continue accessing the mutex structure after releasing the lock, meaning the underlying object must still be valid at that moment. When a USB device is physically disconnected while a userspace process still holds the file descriptor open, the disconnect() callback and the release() file-operation race. Because mutex_unlock() does not provide object lifetime guarantees, the driver data structure can be freed while mutex_unlock() is still referencing it. The fix replaces direct lifetime management with a kref (kernel reference counter), which atomically tracks outstanding users of the driver data and defers the final kfree() until all users have dropped their reference, eliminating the use-after-free window. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* identifies the upstream kernel codebase across all affected versions.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Race condition exploitation requires precise timing between disconnect() and release(), warranting AC:H; local authenticated user is the minimum privilege (PR:L, AV:L); UAF in kernel can yield full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 6.3 MEDIUM
AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.0 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 03, 2026 - 16:07 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

USB: legousbtower: fix use-after-free on disconnect race

mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2]

Use a kref to release the driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect().

[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most other sleeping locks, can still use the lock object after it's unlocked")

Executive ViewAI

Why It Matters

The Linux kernel legousbtower USB driver contains a use-after-free vulnerability allowing authenticated local users with LEGO USB Tower devices to escalate privileges or crash systems. Organizations operating Linux infrastructure with this hardware face potential unauthorized system access and service interruption.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 87% exploitable
Prevalence
Rare
niche legacy LEGO Mindstorms USB peripheral, negligible modern deployment
Data Quality
5 sources
Confidence: Medium
EUVD 🇯🇵JVN NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64340 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/383135 REF https://git.kernel.org/stable/c/0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e REF https://git.kernel.org/stable/c/11d069f85851997b4ea0adf242ed9672dc749b8f REF https://git.kernel.org/stable/c/62fc8eb1b1481051f7bab4aa93d79809053dd09f REF https://git.kernel.org/stable/c/6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee REF https://git.kernel.org/stable/c/766738ecf2b819e54d38763c8d1c8ae6cff14b39 REF https://git.kernel.org/stable/c/9ba62966461a8e3cc593b62c56ec62eb2d80436d REF https://git.kernel.org/stable/c/ab2bfd7bec4f134b377ec42f513e90c35db94160 REF https://git.kernel.org/stable/c/b4222c05066b252b451f9c8c4730b5b60824ea66

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy