Skip to main content

Linux Kernel EUVDEUVD-2026-48885

| CVE-2026-64341 HIGH
Use After Free (CWE-416)
2026-07-25 Linux GHSA-jfg4-c35c-vjq6
Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition requires precise disconnect/release timing, raising AC to H; all other metrics match the local, low-privilege driver exploit model.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 03, 2026 - 16:40 vuln.today
tag: Information Disclosure removed
Analysis Generated
Sep 03, 2026 - 16:08 vuln.today
CVSS changed
Sep 03, 2026 - 16:07 NVD
7.8 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

USB: iowarrior: fix use-after-free on disconnect race

mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2]

Use a kref to release the driver data to avoid use-after-free in mutex_unlock() when release() races with disconnect().

[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic") [2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most other sleeping locks, can still use the lock object after it's unlocked")

AnalysisAI

Use-after-free in the Linux kernel USB iowarrior driver allows a local unprivileged user to corrupt kernel memory when a USB device disconnect races with a file release operation. The root cause is that mutex_unlock() is documented as non-atomic and may access the mutex structure after releasing the lock, meaning the driver data object can be freed while mutex_unlock() is still executing. An attacker who can trigger the race - by opening the iowarrior device and simultaneously provoking a USB disconnect - may achieve kernel memory corruption leading to privilege escalation. No public exploit code exists and EPSS is low (0.21%), but the impact class is standard kernel UAF.

Technical ContextAI

The iowarrior driver (drivers/usb/misc/iowarrior.c) manages Code Mercenaries IO-Warrior USB HID devices in the Linux kernel. The vulnerability stems from CWE-416 (Use After Free): the driver allocated and freed its per-device private data structure under a mutex, but mutex_unlock() in the Linux locking subsystem is documented (see commit a51749ab34d9 and 2b9d9e0a9ba0) to potentially access the lock object after it is unlocked - making it unsafe to free the containing structure immediately before or after mutex_unlock(). When the USB subsystem calls disconnect() concurrently with a userspace process executing release(), both paths can operate on the same driver-data allocation, resulting in a use-after-free in the mutex_unlock() path. The fix replaces lifetime management with a kref (kernel reference count), ensuring the driver-data object is freed only after all references are dropped. Affected CPE: cpe:2.3:a:linux:linux:*.

RemediationAI

Update to a patched Linux kernel version: 7.2-rc3, 7.1.4, or 6.12.97 per stable channel. Apply the upstream fix commits from git.kernel.org/stable/c/3c0a7b29ebb391d5f50b115e86f842b709195b08, git.kernel.org/stable/c/71590982700fdeb39a37a500c877228b0140978e, or git.kernel.org/stable/c/c602254ba4c10f60a73cd99d147874f86a3f485c depending on the running branch. As a compensating control where patching is not immediately possible, blacklist the iowarrior kernel module (add 'blacklist iowarrior' to /etc/modprobe.d/) to prevent the driver from loading - note this disables all IO-Warrior USB devices. On systems where no IO-Warrior hardware is used, this workaround has no functional impact. Additionally, restrict physical USB port access and enforce kernel module loading policies (e.g., via module signing or lockdown mode) to reduce the attack surface.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Use After Free

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8
CVE-2012-4969 HIGH POC
8.1

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

EUVD-2026-48885 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy